Partnership Overview
Proofpoint and SailPoint combine human-centric risk intelligence with identity governance to protect your most attacked people and automate remediation the moment risk is detected. Since 2020, Proofpoint has shared Very Attacked People (VAP) risk data, powered by the Proofpoint Attack Index and Nexus AI threat platform, directly with SailPoint Identity Security Platform. The result is risk-informed governance that applies tighter access policies and automated remediation to your most high-risk identities in real time, not static role assumptions.
Risk-informed governance
Identity access decisions are informed by real-time attack data, reflecting who's being targeted, how, and by whom, not static role definitions alone.
Faster remediation of compromised users
When Proofpoint detects a likely compromise, SailPoint can automatically require reauthentication, adjust access, or trigger a review.
Unified visibility across risk and access
Identity and security teams share a single view of who is being targeted and how access has been adjusted in response, instead of correlating data across disconnected tools.
Growing Identity Risk
Attackers increasingly target specific people to gain a foothold, then pivot to escalate privileges and reach sensitive systems and data. Traditional identity governance relies on static, periodic access reviews that can't keep pace with in-the-moment threats, leaving high-risk accounts over-provisioned between review cycles.
VAP Intelligence
|
Since 2020, Proofpoint has identified your Very Attacked People (VAPs) using the Proofpoint Attack Index, which scores users by attacker sophistication, targeting type, and attack volume. That VAP risk data flows into SailPoint Identity Security Platform, so SailPoint can apply more frequent certifications or tighter access policies to the accounts most likely to be compromised. |
VAP Risk Scoring
Continuously score users on real attack behavior, not assumed seniority or title, to identify your true highest risk accounts.
Proofpoint-SailPoint Connector
Share VAP and human-centric risk context directly with the SailPoint identity platform so governance reflects live threat data.
Adaptive Certification Policies
Automatically trigger more frequent certifications or adjusted access levels for your riskiest identities.
Automated Remediation
When Proofpoint detects that a user has clicked a malicious link or otherwise shows signs of compromise, it notifies SailPoint in real time. SailPoint can then automatically require a password reset, trigger step-up authentication, or revoke access outright, shrinking the window an attacker has to exploit a compromised account.
Compromise Detection Alert
Proofpoint flags a likely account compromise, such as a malicious link click, and shares it immediately with SailPoint.
Automated Remediation Actions
SailPoint can automatically require a password reset, trigger step-up authentication, or revoke access for the affected user, without manual SOC or IAM intervention.
Adaptive Access Revocation
Access and entitlements adjust automatically based on the confirmed or suspected risk level of the account.
Request a Demo
Thank you!
A Proofpoint cybersecurity specialist will reach out to you shortly.
Recommended for You
Proofpoint identifies your Very Attacked People (VAPs) using the Proofpoint Attack Index and shares that risk context with SailPoint, which applies risk-based governance, including more frequent certifications, adjusted access levels, and automated remediation such as forced password resets, step-up authentication, or access revocation, to your highest-risk identities.
SailPoint's identity governance treats access as largely static between review cycles. Proofpoint's real-time risk intelligence has no way to act on an identity directly. Together, they close that gap: Proofpoint tells SailPoint who's being targeted or compromised, and SailPoint adjusts or revokes access immediately.
SailPoint governs identity. Proofpoint tells it who's being attacked. Together, they apply access policy based on real, measured attack risk rather than static role assumptions, and automatically adjust or revoke access the moment Proofpoint detects a likely compromise.
Very Attacked People (VAPs) are the individuals in your organization most targeted by attackers, as measured by the Proofpoint Attack Index across attacker sophistication, targeting type, and attack volume. Because these users are disproportionately likely to be compromised, applying standard, one-size-fits-all access governance to them leaves a gap: VAPs need tighter, risk-adjusted controls, which is what the SailPoint integration automates.
Proofpoint shares risk signals with SailPoint, including Very Attacked People (VAP) scores and real-time compromise alerts. SailPoint uses this context to apply more frequent certifications, adjust access levels, and trigger automated remediation on the riskiest accounts.
