Proofpoint joins Microsoft Defender for Office 365 ICES ecosystem; Check Point contests verdict handling and quarantine
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 07/11/2026 00:05; os links antigos trazem para cá.
Proofpoint announced on October 26, 2026 that it joined the Microsoft Defender for Office 365 Integrated Cloud Email Security (ICES) vendor ecosystem, letting Microsoft 365 customers layer Proofpoint Core Email Protection API over their Microsoft environment and see Proofpoint detections in the Microsoft Defender portal (proofpoint.com). This is a vendor partnership and product update, not a security incident or vulnerability disclosure. On November 6, 2026, Check Point published a vendor blog post contrasting its Email Security quarantine management with the Proofpoint integration (blog.checkpoint.com). Neither source contains vulnerability, threat actor, malware or IOC information. Proofpoint's efficacy figures are vendor claims and have not been independently verified.
Detalhes técnicos
- The Proofpoint integration is API-based and shows its detections alongside Microsoft detections in one console, intended to reduce context switching and streamline SOC investigations (proofpoint.com).
- Proofpoint claims 99.999% detection efficacy, powered by Proofpoint Nexus AI, against phishing, business email compromise and ransomware, and says it protects more than 1.8 million Microsoft customers (proofpoint.com). These claims are unverified.
- Within ICES, Microsoft Defender applies enforcement based on submitted verdicts, verdict severity and configured policies, with highest-severity verdict precedence. A third-party clean classification therefore does not override a Microsoft malicious verdict (blog.checkpoint.com).
- Check Point says its Unified Quarantine, offered since 2023, merges Microsoft-native and Check Point quarantines into one administrative experience. Administrator-configured policies can automatically restore eligible messages it classifies as safe, including some that Microsoft marked as high-confidence phishing (blog.checkpoint.com).
- In deployments combining a Secure Email Gateway (SEG) with an API integration, messages blocked pre-delivery by the SEG may not appear in Defender's unified quarantine (blog.checkpoint.com).
- Microsoft announced the ICES Vendor Ecosystem in June 2025 (blog.checkpoint.com).
Remediação
No patching or detection action is required. Teams running layered email security should document where quarantined messages are managed in gateway-plus-API deployments and review which engine's verdict prevails. Automatic restoration of messages flagged as high-confidence phishing by a second engine risks releasing real phishing to users (blog.checkpoint.com).
Linha do tempo
-
Check Point vendor post contrasts its Unified Quarantine with Proofpoint's entry into Microsoft ICES ecosystem
ler a análise desta fonte ocultar
A Check Point blog post positions its Email Security quarantine management against Proofpoint's integration with Microsoft's Integrated Cloud Email Security (ICES) vendor ecosystem. The post is vendor marketing and contains no vulnerability, threat actor, malware or incident information. It states that within ICES, Microsoft Defender applies enforcement based on submitted verdicts, verdict severity and configured policies, following highest-severity verdict precedence, so a third-party clean classification does not override a Microsoft malicious verdict. Check Point argues its Unified Quarantine, offered since 2023, merges Microsoft-native and Check Point quarantines into one administrative experience and allows administrator-configured policies to automatically restore eligible messages it classifies as safe, including some Microsoft marked as high-confidence phishing. It also notes that in a deployment combining a Secure Email Gateway with an API integration, messages blocked pre-delivery by the SEG may not appear in Defender's unified quarantine. The post recalls that Microsoft announced the ICES Vendor Ecosystem in June 2025.
Remediation
No patching or detection action is required. Teams running layered email security should document where quarantined messages are managed in gateway-plus-API deployments and review which engine's verdict prevails, noting that automatic restoration of messages flagged as high-confidence phishing by a second engine introduces a risk of releasing real phishing to users.
-
Proofpoint joins Microsoft Defender for Office 365 ICES ecosystem with Core Email Protection API integration
ler a análise desta fonte ocultar
Proofpoint announced on October 26, 2026 that it has joined the Microsoft Defender for Office 365 Integrated Cloud Email Security (ICES) vendor ecosystem. Microsoft 365 customers can now layer Proofpoint Core Email Protection API on top of their Microsoft security environment and view Proofpoint detections directly in the Microsoft Defender portal. The announcement is a vendor partnership and product update, not a security incident or vulnerability disclosure. Proofpoint claims 99.999% detection efficacy, powered by Proofpoint Nexus AI, against phishing, business email compromise and ransomware. It also says it protects more than 1.8 million Microsoft customers.
Technical Details
- The integration is API-based and shows Proofpoint detections alongside Microsoft detections in a single console.
- It is intended to reduce context switching for SOC teams and streamline investigations.
- The efficacy figures are vendor claims and have not been independently verified.