Proofpoint extends AI investigations to Microsoft 365 and insider risk
Proofpoint has announced two enhancements to its communications intelligence platform: a direct Microsoft 365 connector for its Prism Investigator tool and an extension of its Human Communications Intelligence (HCI) agents to capture interactions with generative AI applications, copilots, and AI agents in insider threat investigations.
The additions, announced from Dubai on 15 September 2026, are positioned by the company as a step away from "stitched-together tools" towards a unified platform spanning data security, insider risk management, and digital communications governance.
What has changed
Prism Investigator previously required content to be held in Proofpoint Archive before AI-driven investigation workflows could begin. The updated connector pulls email, Teams messages, and files directly from Microsoft 365 as an investigation develops, correlating live content with archived records, logs, and other business data to produce what the company describes as a defensible case narrative. The Microsoft 365 connectivity is currently in development and is expected to reach general availability in Q4 2026.
The HCI update is available now as an add-on to Proofpoint Capture, which is powered by the company's Nuclei technology. It brings AI communications governance signals, including prompts submitted to and responses received from AI tools, into the behavioural context used by Proofpoint Insider Threat Management. The rationale is that a prompt entered into a corporate AI tool can constitute a data-exposure event, and the surrounding communications record can help investigators assess whether the behaviour represents routine use, a policy breach, or something more deliberate.
Harry Labana, SVP and general manager for Digital Communications Governance at Proofpoint, framed the capability in analogy terms: "Like a cockpit voice recorder, it gives investigators more than a simple audio file, providing extensive details to piece together the events and intent behind them."
Market context
The insider risk and communications compliance market has grown significantly as enterprise adoption of generative AI tools has accelerated. Proofpoint competes in overlapping categories: Microsoft's own Purview compliance and Insider Risk Management suite sits inside the Microsoft 365 tenants that Proofpoint is now targeting for direct integration, making the relationship partly competitive and partly complementary. Other established players in the space include Mimecast, Forcepoint, and Code42, alongside a broader set of data loss prevention vendors.
The specific challenge of governing AI interactions is newer territory. As employees use copilots and AI agents for substantive business tasks, those interactions increasingly carry the same regulatory weight as email or messaging records in sectors such as financial services, healthcare, and legal services. Regulators in the UK and EU have begun signalling that AI-generated business communications may fall within existing record-keeping obligations, even where AI-specific rules are not yet in force.
Regulatory read-across
For financial services firms in particular, the extension of communications capture to AI tools will resonate with requirements under MiFID II (Europe) and SEC Rule 17a-4 (United States), both of which mandate preservation of business-related electronic communications. The UK's FCA has similarly emphasised that existing communications surveillance obligations extend to newer collaboration channels. As AI tools become a standard part of the communications record, the pressure on compliance teams to capture and monitor AI interactions will intensify, irrespective of forthcoming AI-specific regulation under the EU AI Act.
Proofpoint serves over 80 of the Fortune 100 and more than 14,000 large enterprises according to its own figures, giving the platform broad potential exposure for both updates. The company did not disclose pricing for the HCI add-on or release benchmark performance data for Prism Investigator's Microsoft 365 retrieval speeds.