A single system for intent and access to empower organizations to adopt AI without losing data control or missing emerging risks across employees and AI agents

• Point security tools were built to see either AI behavior or data risk, not both. Proofpoint is the first vendor to reason across both in one shared graph.
• Zero-Touch Detection, Instant Investigation and Protection Optimization, powered by three autonomous agents, keep pace with AI-driven risk continuously, with simplicity and scale.
• New Semantic Business Policies and Agentic Insights enforce business intent and continuously uncover emerging risks across employees and AI agents.
  

SUNNYVALE, Calif., Sept. 22, 2026 (GLOBE NEWSWIRE) -- Proofpoint Protect 2026, San Diego – Proofpoint, Inc., a global leader in human and agent cybersecurity, today announced the Proofpoint Agentic Data and AI Security system, built to secure AI and data as one connected risk. Its innovative capabilities enable organizations to safely deploy AI agents with access to only the data they need based on intent, while translating existing business policies into runtime controls and continuously uncovering emerging risks across human and autonomous AI activity.

AI agents now discover, access, transform, and act on sensitive data at a scale no manual review can match. AI tools often see intent but not data access, and data tools see sensitive data but not agent intent. As those interactions multiply, seeing only half the picture leaves critical risk unseen. Securing AI and data separately is no longer enough; it takes a system that can act as fast as the risk appears.

Additionally, AI governance now extends beyond data loss. Agents can interact with enterprise systems, make decisions, and execute transactions, creating financial, operational, compliance, and safety risks. Proofpoint’s 2026 AI and Human Risk Landscape report found that 87% of organizations have moved AI assistants beyond pilot, yet 52% aren’t confident their controls could detect a compromise. Security teams now need to define and enforce AI behavior in real time.

"You cannot secure AI without securing the data it acts on, and you cannot secure data without understanding how AI is using it," said Mayank Choudhary, executive vice president and general manager, Data Security and Governance Group, Proofpoint. "Intent and access are two sides of the same coin. Securing them separately leaves critical context behind. Bringing AI run-time protections and AI data governance together gives organizations that context, and the ability to act on risk at the speed AI now moves."

One Agentic System for AI
The agentic system reasons at the agent level, using the same identity, access, and data context that already secures more than 14,000 enterprises' data today. It is built on the Proofpoint Knowledge Graph, which is the foundation, connecting AI activity with data sensitivity, identity, access, behavior, and intent through Nexus models. On top of it, three new agents work from one shared understanding of risk instead of three partial ones:

• Zero-Touch Detection: The Detection Agent sees intent and access as a single signal, surfacing the handful of actions that matter instead of the flood of anomalies traditional tools can't stop generating.
• Instant Investigation: The Investigation Agent reconstructs what happened across data, identity and behavior automatically, turning an investigation that once took days of manual correlation into minutes.
• Protection Optimization: The Remediation Agent turns that understanding into action, from access remediation to DLP policy optimization, with a human in the loop for governance.
  

Deepening AI Runtime Security: Turning Business Intent into AI Runtime Controls
Organizations need to enforce the rules they've already set for how AI should behave and catch the risks they never thought of writing a rule for in the first place.

Proofpoint Semantic Business Policies translate existing governance requirements into continuously enforced AI controls. An organization can take a rule already written into its code of conduct, such as prohibiting interactions with gambling content, and express it in plain language: "Do not allow interactions with gambling content." Proofpoint interprets the intent behind the policy, identifies the systems capable of carrying it out, and generates the runtime controls to enforce it automatically. Combined with Proofpoint Intent-Based Access Control, these policies evaluate AI behavior against both enterprise requirements and an agent's intended purpose, whether an employee is acting through an AI assistant or an autonomous agent is acting on their behalf at AI speed.

Finding the Risks Enterprises Have Not Yet Defined
Agentic Insights uses autonomous reasoning agents to analyze AI interactions, tool usage, policy decisions, and behavioral patterns to uncover emerging risks. When a risk is validated, Proofpoint can recommend a Semantic Business Policy to govern similar behavior, turning new intelligence into enforceable protection.

Across AI and data security workflows, purpose-built detection, investigation, and remediation capabilities turn connected context into autonomous action, while Semantic Business Policies and Agentic Insights keep pace with risks the organization hasn't defined yet. Together, they prioritize real risk, speed investigations with data, identity, access, and behavioral signals, and reduce exposure through actions like access remediation, DLP policy optimization, and enforceable runtime controls to cut manual work as AI activity scales.

“Organizations have spent decades defining how their businesses should operate,” said Ryan Kalember, chief strategy officer, Proofpoint. “The challenge now is making those rules enforceable as AI takes on more consequential work. Business intent needs to become part of the security control itself, with the ability to identify new risks and adapt as AI behavior evolves.”

Availability
Capabilities within the Proofpoint Agentic Data and AI Security System, as well as Semantic Business Policies and Agentic Insights, are expected to be available by year-end 2026.

For more information, visit our blogs: https://www.proofpoint.com/us/blog/data-security/ai-changes-security-model-data-and-ai-security-must-change-it and https://www.proofpoint.com/us/blog/ai-security/operationalizing-security-agentic-era.

About Proofpoint, Inc.
Proofpoint, Inc. is a global leader in human and agent cybersecurity, securing how people, data and AI agents connect across email, cloud and collaboration tools. Proofpoint is a trusted partner to over 80 of the Fortune 100, over 14,000 large enterprises, and millions of smaller organizations in stopping threats, preventing data loss, and building resilience across people and AI workflows. Proofpoint’s collaboration, data, and AI security platform helps organizations of all sizes protect their people, defend their data, and adopt AI securely and confidently. Learn more at www.proofpoint.com.

Connect with Proofpoint on LinkedIn.

Proofpoint is a registered trademark or tradename of Proofpoint, Inc. in the U.S. and/or other countries. All other trademarks contained herein are the property of their respective owners.

PROOFPOINT MEDIA CONTACT:
pr@proofpoint.com