Proofpoint expands insider-risk tools to Microsoft 365

Proofpoint has expanded its investigation tools to cover Microsoft 365 content and employee interactions with AI systems, extending insider-risk inquiries beyond traditional email and file activity.

The changes affect its Prism Investigator product and Human Communications Intelligence offering, which security, compliance, and legal teams use to examine incidents and build case records.

Prism Investigator will now connect directly to Microsoft 365 email, Teams, and files. Investigators will be able to pull relevant material into an inquiry as it develops instead of exporting content into an archive first.

The system can combine Microsoft 365 material with archived communications, logs, data, and other business records. That is intended to help investigators assemble a documented account of events for internal reviews and matters involving regulators or legal teams.

Broader trail

The second change focuses on how organisations assess insider risk when staff use generative AI tools, copilots, and AI agents. Prompts, uploaded documents, and AI-generated responses are becoming part of the communication trail investigators need to review.

Human Communications Intelligence agents now bring those AI interactions into insider-risk investigations, allowing teams to compare activity in AI tools with a person's emails, messages, file use, and wider behaviour.

That comparison is designed to help determine whether an action was ordinary work, a breach of policy, or a deliberate attempt to misuse information. One example the company gave was an employee pasting a customer contract into an AI tool, which could indicate possible data exposure without showing intent on its own.

By reviewing the AI exchange alongside other communications and records, investigators may be better able to judge whether the action reflected convenience, negligence, or malicious behaviour. This reflects a wider shift in workplace monitoring as AI tools become more embedded in daily tasks.

Context focus

Businesses have spent years using security tools to flag unusual access, file movement, or outbound communications. For many teams, the challenge is that alerts often show an event occurred but offer little context about why it happened.

Proofpoint is positioning the latest changes around that problem, arguing that AI use creates a new layer of digital activity that needs to be preserved and examined alongside other records. As organisations allow staff to use AI systems for drafting, research, and workflow support, prompts and responses can form part of an evidential trail.

Harry Labana, Senior Vice President and General Manager, Digital Communications Governance at Proofpoint, commented on the rationale for the update.

"Security teams don't need another disconnected alert," said Harry Labana, Senior Vice President and General Manager, Digital Communications Governance at Proofpoint.

"While an alert can indicate what happened, it's communications intelligence that can explain the why. Like a cockpit voice recorder, it gives investigators more than a simple audio file, providing extensive details to piece together the events and intent behind them. By extending intelligence across Microsoft 365 and interactions with AI, we're bringing that same depth of context to security, compliance, and legal investigations," Labana said.

Product timing

Human Communications Intelligence agents are currently available as an add-on to Proofpoint Capture powered by Nuclei. Connectivity from Prism Investigator to Microsoft 365 is expected in the fourth quarter of 2026.

The update also reflects the commercial importance of Microsoft 365 as a source of business communications, documents, and collaboration records. For vendors in compliance, governance, and insider-risk monitoring, direct access to that environment can reduce friction for customers that do not want to move or duplicate large volumes of content before starting an investigation.

Proofpoint says it serves more than 80 of the Fortune 100, more than 14,000 large enterprises, and millions of smaller organisations. The new functions sit within its broader platform spanning data and AI security, insider risk, and digital communications governance.

The added AI visibility suggests how the insider-risk market is changing as companies try to distinguish between acceptable use of AI at work and behaviour that could expose data or breach policy. In that setting, the quality of an investigation may depend less on a single alert than on whether teams can connect messages, documents, system logs, and AI exchanges into one auditable narrative.