Proofpoint’s Core Email Protection API solution joins the Microsoft Defender ICES vendor ecosystem

Microsoft

Oct 26, 2026

Email remains the most exploited gateway for cyberattacks, as the threat landscape continues to get more sophisticated with attackers using AI to scale phishing, malware, and business email compromise. Microsoft Defender is a leading email security solution, helping organizations stay ahead of these threats with a modern, cloud-native approach. At the same time, many organizations choose to layer additional email security solutions to meet compliance requirements or align to an existing defense-in-depth strategy. This approach can strengthen resilience, but it can also add operational complexity for SOC teams. That’s why one year ago, we introduced the Microsoft Defender Integrated Cloud Email Security (ICES) vendor ecosystem, which is designed to simplify that complexity by integrating partner protections into Microsoft Defender.

Today, we’re continuing to expand the ICES vendor ecosystem by adding Proofpoint Core Email Protection API. Proofpoint joins existing members Darktrace, KnowBe4, Cisco, and VIPRE Security Group.

How joint customers benefit from a streamlined SOC experience in Microsoft Defender

The ICES ecosystem brings trusted third-party email security verdicts and telemetry into the Defender portal through an API-based integration model. This allows Microsoft Defender to acknowledge partner verdicts on messages, apply the highest-severity determination, and surface that information in the same investigation and response workflows security teams already use. The integration with Proofpoint Core Email Protection API is designed specifically for customers who have already chosen to deploy Proofpoint’s ICES solution alongside Microsoft Defender. It supports environments where customers run both solutions and want to reduce friction for their SOC teams. By integrating Proofpoint into the ICES ecosystem, customers can now preserve their existing security strategy while improving how investigations and response are carried out day to day.

"Organizations rely on both Microsoft and Proofpoint to protect their most critical communications and data. By extending Proofpoint’s interoperability across ICES, we’re delivering a more unified security experience that strengthens defense-in-depth and simplifies operations for our shared customers. This milestone reflects our commitment to joint customers worldwide.”

- Tom Corn, EVP and GM, Threat Protection Group at Proofpoint

Below we have outlined how Proofpoint’s ICES solution now integrates within Microsoft Defender:

Unified quarantine: Quarantine is the central place where suspicious, unwanted, or malicious messages are held so they do not remain in users’ mailboxes while analysts review them. With unified quarantine, teams can view and manage quarantined email from both Defender and supported ICES vendors in one experience. The benefit is less context switching, faster triage, and a more consistent response workflow because analysts do not need to jump between separate admin consoles to understand what was held and why. In Figure 1, you can see that in the column “detection technology” ThirdPartyFiltering is listed, indicating to you that this was directly contributed by Proofpoint’s Core Email Protection API solution.

Figure 1: Emails quarantined by Proofpoint Core Email Protection API show up in the quarantine experience in Defender, alongside Defender-quarantined emails.

Streamlined operations: ICES integrations make Defender more actionable for SOC teams by extending familiar investigation experiences across Microsoft and partner-detected email. In Threat Explorer, analysts can review messages actioned by Defender and integrated partners in one place, making it easier to correlate verdicts and understand which layer acted on a message.

Figure 2 and 3: Shows how you can review emails actioned by Proofpoint by using ‘ThirdPartyFiltering’ in Threat Explorer. Click on a particular row and dive deeper into delivery and email details.

In Advanced Hunting, teams can query email events that include third-party detections to investigate patterns, validate coverage, and hunt for missed or emerging threats. And on the Email entity page, analysts can see message-level details and action history, including which product took action and what verdict was assigned. Together, these experiences give teams a more complete investigation workflow without forcing them to jump between separate consoles.

Figure 4: Shows the Advanced Hunting page in the Defender portal where analysts can query email events, including third-party detections.

Reinforcing Our Commitment to Customer Choice

The continued expansion of the ICES vendor ecosystem reinforces Microsoft’s commitment to supporting customers who strategically layer email security solutions. The goal of our ecosystem is making multiple solutions operationally effective together with Microsoft Defender as the shared Security Operations experience.

By integrating partner signals directly into the Defender portal, customers can reduce analyst fatigue, improve consistency across email threat response, and scale their security posture while reducing the operational complexity of managing layered solutions.