Cofense, Egress, Mimecast and Proofpoint

About Egress

Egress, a KnowBe4 company, is a cloud email security provider that says it continuously assesses human risk and dynamically adapts policy controls, defending against advanced phishing attacks and outbound data breaches. Egress says it uses contextual machine learning and neural networks, with integration through a cloud-native API architecture. Egress says KnowBe4's acquisition of Egress created the largest AI-driven cybersecurity platform for managing human risk. KnowBe4 says it entered into a definitive agreement to acquire Egress.

Defend is KnowBe4's inbound email security solution. Defend uses AI and natural language processing to map historical communication patterns and identify anomalies. Defend rewrites links and checks them at time of click, and Defend detects QR codes within email. Active and malicious code is automatically disabled from HTML message bodies and attachments. Sender policy verification lookup and validation are performed on every message for SPF, DKIM and DMARC. Defend filters graymail to a separate folder. Defend uses AI to automate inspection of user-reported phishing emails and remediate attacks across the enterprise.^[7]

Defend performs time-of-click inspection to detect malicious URLs that are weaponized post-delivery. Phishing is one of the most common attack vectors for ransomware. Egress says 90% of ransomware starts with a phish and that Defend uses AI-powered analysis to stop malicious links and payloads.^[8][9]

On the outbound side, security administrators can configure their risk appetite for data exfiltration and deploy KnowBe4 Prevent to block activity, warn users when they are about to contravene policy, or monitor user activity without end-user notification. Prevent uses AI technology to analyze recipients for signals that an address may be a personal account linked to the sender. Prevent analyzes attachments for sensitive content and verifies them against the intended recipients. Administrators can control and report on exfiltration incidents through an approve/reject workflow. Protect is secure, certified end-to-end email encryption, and Workspace is a way to collaborate and share securely. The Security Center is a single portal for risk analysis, reporting and incident triage, investigation and response for the KnowBe4 Cloud Email Security products Defend, Prevent and Protect, including a live threat feed.^[7][10]

Defend integrates into Google Workspace and MS Outlook apps on Windows Desktop, Mac, iOS and Android. Defend operates after a SEG, Google or Microsoft 365 has performed analysis. KnowBe4 Cloud Email Security is integrated into Microsoft 365, including support for Mac and OWA users.^[7][11]

KnowBe4 says attackers increasingly target attorneys and support staff, who have access to valuable client information. KnowBe4 also addresses financial services organizations, with email and human error as the focus. A customer quoted by KnowBe4 selected Defend and Prevent as added security layers in its Microsoft 365 environment.^[12][13]

The KnowBe4 Platform provides attack simulation and training, email and collaboration security, and agent security powered by AIDA (Artificial Intelligence Defense Agents) and a proprietary Risk Score. KnowBe4 says more than 70,000 organizations worldwide trust it. KnowBe4, Inc gives its address as 33 N Garden Ave, Suite 1200, Clearwater, FL 33755. Vista Equity Partners took KnowBe4 private, and KnowBe4 raised $300 million in a round led by KKR.^[7]

KnowBe4 states that all of its products are SSAE18 SOC 2 Type 2 certified and Cyber Essentials certified. KnowBe4 has been audited against the International Organization for Standardization 27001:2022 standard covering information security controls and the 42001:2023 standard covering AI management systems. KnowBe4 maintains compliance with the GDPR. KnowBe4 uses AWS and Azure for data encryption in transit (TLS) and at rest (AES-GCM 256).^[12][14]

About Mimecast

Mimecast describes the problem it addresses as human risk. Its solutions page says Mimecast offers a unified and dynamic solution to rapidly identify and reduce risk caused by human actions and to empower users to make smarter security decisions. Mimecast says a unified platform with integrated protection across email, chat and file-sharing is essential to safeguard an organization's collaboration.^[2][5][15]

For email and collaboration threat protection, Mimecast says its solution blocks phishing, BEC, impersonation, malware and collaboration-based attacks using adaptive AI across email, Teams, Slack and more.^[2][11][16]

Mimecast Managed Threat Response is a managed service for emails that users report. Mimecast says each report is analyst-investigated, classified and remediated 24x7. Mimecast says the service works with the existing report button and that API outputs route to a SIEM, SOAR or case management platform.

For insider risk, Mimecast Incydr is the data protection product. Mimecast says Incydr brings email, endpoint, cloud, browser and agentic risk surfaces into one view, scored for risk and tied back to people. Mimecast says Incydr offers adaptive controls that range from in-the-moment education to allow-with-justification to targeted blocking. The Agent Risk Center, part of Mimecast Incydr, discovers the agents operating in an environment, classifies their AI activity against the customer's rules, and applies controls to reduce data exposure. Mimecast says Incydr offers data residency options and FedRAMP-authorized solutions, and that an ultra-lightweight agent supports Windows, Mac and Linux.^[2][9][18]

For security behavior management, Mimecast Engage delivers behavior-driven interventions powered by the Human Risk Command Center. Mimecast says Engage can deliver nudges via email, Slack or Teams, and that it offers 200+ training modules available in 27 languages. Mimecast says Engage connects with security tools such as CrowdStrike, Okta and Netskope.^[2][7]

For archiving, Mimecast Cloud Archive provides self-service tools to collect, discover, preserve and review collaboration data. Mimecast says Supervision supports review, escalation, export and reporting, Sync & Recover protects files, folders, contacts, tasks and notes, and Archive for MS Teams keeps encrypted copies of Teams data.^[9]

Mimecast says it protects and supports 42,000+ organizations globally and has done so since 2003. Its pages say it offers 300+ integrations.^{[2][9][10][11][17][18]}

About Proofpoint

Proofpoint sells security that covers data and AI as one system, with access that follows intent. Proofpoint describes the problem it addresses as cyberattacks evolving as people and AI agents work side by side across email, cloud and collaboration tools. Proofpoint describes its approach as understanding intent in order to protect every interaction. Proofpoint has signed a definitive agreement to acquire Varonis.^[2]

Proofpoint uses intent-based detection models and autonomous agents to stop AI-scaled threats across the attack chain.

Proofpoint covers visibility into sensitive data and every person, AI app and agent using it, including shadow AI. Proofpoint covers stopping data loss and misuse in real time across employee prompts, files and agent actions. Proofpoint covers control over who and what can reach data, with a full audit trail.

A Proofpoint customer describes using Proofpoint in two areas: AI security for employees using AI services and tools, and AI security in the tools and agents that customer is building. A Proofpoint customer describes Proofpoint email security, DLP and insider threat management working together, with its analyst using a single security console for all possible issues.^[2]

ITM / Endpoint DLP features are supported on Windows, Mac and Linux, depending on the feature. ObserveIT is a division of Proofpoint. ObserveIT installation includes granting the ObserveIT Service Account user the dbcreator role on the SQL server. The service account permission is required only during the installation phase and may be removed once installation is complete. Removing that permission prevents ObserveIT from creating additional archive databases with the service account.^[19][20]

Proofpoint Threat Intelligence Services provides Threat Insights. Premium Threat Intelligence Services analysts curate threat news highlights. Proofpoint offers ET Intel and ET Pro subscriptions that give full access to all insights.^[21]

Proofpoint research examines how 1,600 CISOs across 16 global markets are navigating AI risk, human behavior, data security and rising business expectations. Proofpoint publishes guidance for reducing AI agent risk while supporting innovation.^[2][13]