Proofpoint plugs into Microsoft’s ICES. One console, more signal.

Proofpoint is sliding its detections straight into Microsoft’s security console. On 26 Oct 2026, the company said it’s joining Microsoft’s Integrated Cloud Email Security (ICES) vendor ecosystem for Microsoft Defender for Office 365.

The new hook-up means Microsoft 365 customers can add Proofpoint’s Core Email Protection API to their existing Microsoft setup and then see those Proofpoint detections inside the Microsoft Defender portal. The promise is fewer tabs for analysts and faster decisions when phishing and business email compromise hit.

What happened

Proofpoint announced that it’s now part of the Microsoft Defender for Office 365 ICES vendor ecosystem, a program that brings third‑party, API‑based email defenses into Microsoft’s environment. The company framed the move as extending its “growing integration with Microsoft services” to deliver a more unified experience for joint customers.

In practical terms, Microsoft 365 customers can layer Proofpoint’s Core Email Protection API into their Microsoft security stack and view Proofpoint detections directly within the Microsoft Defender portal. Proofpoint says that integrated visibility puts its alerts side‑by‑side with Microsoft’s, so investigations don’t require console‑hopping.

Proofpoint’s pitch is defense‑in‑depth with “human‑centric” detection. The company says the API is powered by its Nexus AI and claims 99.999% detection efficacy across common email attack types, including phishing, business email compromise (BEC), and ransomware.

For security operations center (SOC) teams, Proofpoint says the operational upside is less context switching and streamlined workflows. The stated goal is improved response times by consolidating detection and investigation paths under the Defender umbrella that SOCs already use.

Tom Corn, Executive Vice President and General Manager of Proofpoint’s Threat Protection Group, said the integration “strengthens defense‑in‑depth and simplifies operations” for shared customers. He framed it as part of a commitment to a unified experience across Microsoft’s ICES.

Microsoft echoed the focus on the SOC. Oz Wilder, Partner Director for email and collaboration security, said the ICES ecosystem is about a “cohesive defense fabric” anchored in Microsoft Defender. He described the program as a way for customers to adapt and scale with evolving threats while keeping operations consistent.

Proofpoint also flagged its installed base to underline the fit. The company says it protects more than 1.8 million Microsoft customers worldwide, calling participation in ICES a natural next step in the partnership.

The background

ICES, short for Integrated Cloud Email Security, is Microsoft’s vendor program for API‑level email protections that plug into Defender for Office 365. Proofpoint’s entry brings its Core Email Protection API into that ecosystem so detections appear in Microsoft’s portal.

Proofpoint specifies that the integration adds “human‑centric” threat detection on top of Microsoft’s native controls. The company lists phishing, BEC, ransomware, and other sophisticated email‑based attacks as target categories for its detection stack.

Under the hood, Proofpoint points to its Nexus AI as the engine behind the Core Email Protection API. In the announcement, it pegs detection efficacy at 99.999%, an explicit figure designed to signal confidence in the model‑driven stack it’s applying to inbound email threats.

The operational promises are concrete: integrated visibility for analysts, layered protection for defense‑in‑depth, and streamlined workflows that reduce analyst burden. All three are positioned as ways to accelerate investigations and coordinate response without leaving Microsoft’s Defender portal.

Proofpoint is emphasizing interoperability. The company positions this ICES move as an extension of its broader integration with Microsoft services, now focused on embedding more of its detection signal into Microsoft’s native security experience.

The vendor’s credentials lean on reach and scale. Proofpoint describes itself as a global leader in human and agent cybersecurity, securing how people, data, and AI agents connect across email, cloud, and collaboration tools—a scope that matches the ICES focus on cloud‑based integrations.

Beyond Microsoft‑specific numbers, Proofpoint states it’s a trusted partner to over 80 of the Fortune 100, over 14,000 large enterprises, and millions of smaller organizations. Those figures establish market presence, while the “more than 1.8 million Microsoft customers” claim narrows the lens to Microsoft‑aligned deployments.

If your team tracks the email‑security beat, you can browse more coverage on our security hub at /category/security. We’ve also reported on vendor moves that aim to put more security signal where analysts already work, including Microsoft‑facing integrations and tooling (see our earlier context in /news/proofpoint-wants-email-security-to-read-intent-not-just-signals for Proofpoint’s positioning around integrated defenses).

What people are saying

Tom Corn at Proofpoint said organizations rely on both Microsoft and Proofpoint “to protect their most critical communications and data,” presenting the ICES integration as a way to deliver a more unified security experience for joint customers.

Oz Wilder at Microsoft said the goal is a “cohesive defense fabric that drives real efficiency for security operations centers, anchored in Microsoft Defender,” and described the ICES ecosystem as a way to “adapt and scale with the evolving threat landscape.”

Proofpoint underscores that SOC teams can see its detections alongside Microsoft’s in a single console, an arrangement it says helps accelerate investigations and improve response times by reducing context switching.

The company also highlights operational efficiency as a benefit, saying streamlined workflows can reduce analyst burden and enable faster, more coordinated threat response when attacks like phishing, BEC, or ransomware land in user mailboxes.

Proofpoint frames the partnership momentum as accelerating. By citing protection for more than 1.8 million Microsoft customers, the company suggests this ICES step is a natural evolution of the existing relationship into a more tightly integrated security experience for those users.

What happens next

Proofpoint is steering interested teams to two resources: its API email security page and a blog post that recaps the ICES announcement. Those links are included in the release for security leaders who want technical and deployment details.

The company’s language implies that once enabled, detections from Proofpoint’s Core Email Protection API will appear in the Microsoft Defender portal alongside Microsoft’s native alerts. That is positioned as the key change in day‑to‑day SOC workflows for joint customers.

No rollout dates, pricing notes, or migration requirements were provided in the announcement. Proofpoint instead focused on the benefits of integrated visibility, layered defenses, and operational efficiency for existing Microsoft 365 environments.

For teams cataloging their stack, the named components are Microsoft 365, Microsoft Defender for Office 365, the Microsoft Defender portal, and Proofpoint’s Core Email Protection API powered by Nexus AI. Those are the nouns that matter when drafting your enablement checklist.

If you want context on why unified consoles are becoming standard in email defense, our broader coverage at /category/security tracks the push to collapse investigative steps where possible so SOC teams can act faster without sacrificing signal quality.