Proofpoint Insider Threat Management (ITM)
Photo Gallery
 |
Proofpoint Insider Threat Management (ITM)
Additional Info
| Company | Proofpoint |
| Website | http://www.proofpoint.com |
| Company size (employees) | 1,000 to 4,999 |
| Headquarters Region | North America |
| Type of solution | Cloud/SaaS |
Overview
The transition to remote work, acceleration of cloud adoption, and rapid employee turnover has increased the risk of data loss and insider threats. According to the Ponemon Institute, insider threats increased by 44% in 2022, making it imperative for organizations to protect against the harm caused by insiders at the endpoint. Proofpoint provides the leading Insider Threat Management (ITM) solution with more than 1,000 customers globally. We help organizations protect against data loss, malicious acts, and brand damage involving careless, malicious and compromised insiders.
ITM correlates user behavior and data movement that enables security teams to detect, investigate, and respond to potential insider threats. Proofpoint ITM delivers real-time alerts, contextual intelligence on users, data and threats, and helps accelerate investigations with easy-to-understand evidence of wrongdoing.
ITM delivers six key capabilities necessary for managing risky behavior on the endpoint:
1.Visibility and context on user behavior, file activity and file content in a clear timeline
2.Detection and alerting on risky user behavior and data interactions in real time
3.Prevention against data loss through common endpoint channels such as print, web uploads, cloud sync folders, USB connected devices, etc.
4.Accelerated incident response and investigations with collaborative workflows, tagging and a centralized dashboard
5.Simple deployment with a cloud-native platform and a single lightweight endpoint agent that monitors risky and everyday users
6. Protection of user privacy with attribute-based access controls and multiregion data center support
How we are different
Rapid time to value: Proofpoint ITM collects its own telemetry on user activity across applications, files, data, servers, desktops and applications, whether the applications are hosted in the cloud, on the endpoint or on-premises. This provides visibility as soon as the data is collected, which can be trusted coming from one source. Instead, most monitoring solutions are focused on specific technologies, requiring more manual work for security teams. Or they require integrations with many other technologies to provide any visibility, which creates unclean and noisy telemetry.
Real-world insider threat detection and endpoint data loss prevention (DLP): Proofpoint ITM detects risky insider behavior across unauthorized activity and access, risky accidental actions, system misuse and out of policy data movement. We use out of the box and easily customizable rules based on the expertise of 1000+ customers and research institutions such as CERT Insider Threat division, NIST and NITTF. ITM also prevents sensitive data exfiltration through common endpoint channels such as USB connected devices, web uploads, print, cloud sync folders, etc. We detect sensitive data using out-of-box data classifiers and Microsoft Information Protection sensitivity labels. In comparison, most monitoring solutions simply create logs and have rudimentary insider threat detection capabilities.
Context: Proofpoint ITM correlates all activity by user and visualizes it in an activity timeline. In effect, we paint a clear picture of the context of “who, what, where, when, and why” that is understood by cybersecurity and non-cybersecurity teams alike, without any jargon. You can search through security events with keywords and filters across all the collected metadata and screen captures. The sophisticated analytics, role-based workflows and reports accelerate investigations and response. Security monitoring solutions provide logs on the collected activity, while leaving the correlations and analysis to the manual efforts of the security teams.
