Partnership Overview
Proofpoint and CyberArk (now Idira by Palo Alto Networks) connect the people attackers target to the privileged access they want. Proofpoint identifies Very Attacked People and malicious clicks and shares them with CyberArk, which tightens or responds on privileged access, while Proofpoint finds the privileged accounts your Vault doesn't yet manage. The result is privilege protected before it is exploited, from the inbox to the vault.
Tighter control for Very Attacked People
Proofpoint Core Email Protection (TAP) identifies your Very Attacked People and shares them with CyberArk, which applies adaptive privileged access controls so they can access only what they need.
Faster response to a malicious click
When a privileged user clicks a malicious link, Proofpoint shares the click with CyberArk, which can disable features, disable the user, or force a password change in real time.
Fewer unmanaged privileged accounts
Proofpoint Identity Threat Defense continuously discovers local admins and cached credentials and checks them against the CyberArk Vault, flagging accounts that aren't managed.
Privileged Identity Risk
More than 90% of cyberthreats start with email, and many of the people being attacked hold privileged access to critical systems. When email security and privileged access management run as separate disciplines, no one can connect a phishing click to an exposed privileged account, giving attackers the time they need to escalate. Privileged accounts that were never onboarded to the vault leave an even wider gap.
Very Attacked People
Core Email Protection (TAP) identifies your Very Attacked People (VAPs) using the Proofpoint Attack Index, which weighs attacker sophistication, targeting type, attack type, and attack volume, and shares them with CyberArk. CyberArk applies adaptive privileged access controls so those users can access what they need and nothing more. If a privileged user clicks a malicious link, CyberArk can respond in real time.
VAP Risk Sharing
Core Email Protection (TAP) identifies your most targeted users with the Proofpoint Attack Index and shares the list with CyberArk.
Adaptive Privileged Access Controls
|
CyberArk applies adaptive controls and policies to those users, so access stays limited to what they need. |
Malicious-Click Account Response
When TAP detects a malicious click, CyberArk can disable certain features, disable the user, or force a password change.
Vault Coverage
Identity Threat Defense continuously discovers local admin accounts, domain user credentials, and cached credentials across your environment and checks them against the CyberArk Vault. Accounts that are unmanaged or only partially managed are flagged before an attacker can use them. Proofpoint Shadow then runs deceptions and forensics with administrator credentials retrieved from CyberArk Secrets Manager on demand, so Proofpoint never holds them.
Vault Coverage Discovery
Identify privileged and local admin accounts that should be managed in the CyberArk Vault but aren't, including accounts managed on only some machines.
Cached Credential Detection
Continuously discover cached credentials that could let attackers move laterally, and flag those not managed in the Vault.
Deception Without Stored Credentials
Proofpoint Shadow retrieves admin credentials from CyberArk Secrets Manager when needed. They aren't stored in the Proofpoint database, and operation continues when passwords rotate.
Request a Demo
Thank you!
A Proofpoint cybersecurity specialist will reach out to you shortly.
Recommended for You
Proofpoint and CyberArk exchange signals in both directions. Core Email Protection (TAP) shares your Very Attacked People and malicious-click detections with CyberArk, which applies adaptive privileged access controls or responds on the account. Identity Threat Defense checks discovered privileged accounts and cached credentials against the CyberArk Vault, and Proofpoint Shadow retrieves admin credentials from CyberArk Secrets Manager on demand.
CyberArk controls privileged access but doesn't see which privileged users are being targeted, who just clicked a malicious link, or which privileged accounts were never onboarded to the Vault. Proofpoint has that visibility but doesn't vault, rotate, or control privileged credentials. Together, a risk detected in the inbox or the environment triggers the right control on privilege.
Privileged access protected from the inbox to the vault. Know which privileged users are under attack, respond on the account the moment its user clicks, and surface the privileged accounts your Vault doesn't yet manage.
VAPs are the people in your organization most targeted by attackers, as measured by the Proofpoint Attack Index across attacker sophistication, targeting type, attack type, and attack volume. Many hold privileged access, so a compromise has outsized impact. Sharing them with CyberArk lets you apply tighter, adaptive controls where the potential impact is greatest.
Proofpoint shares the VAP list and malicious-click detections with CyberArk. For Vault coverage, Identity Threat Defense queries CyberArk for the list of managed accounts and compares it to what it discovers. For Shadow, credentials are retrieved from Secrets Manager on demand and not stored by Proofpoint. Proofpoint shares the signal; CyberArk performs any account response.
CyberArk is now part of Palo Alto Networks, and its portfolio is branded Idira. The integrations on this page were built with CyberArk products, and product names here reflect those products.
