Proofpoint expands AI investigations into Microsoft 365

Proofpoint has expanded its AI-based investigation tools to cover Microsoft 365 and AI interactions, adding Microsoft email, Teams and file data to its inquiry process.

The update is aimed at security, compliance and legal teams investigating insider risk. One element is available now, while Microsoft 365 connectivity is due in the fourth quarter of 2026.

At the centre of the update is Prism Investigator, which now connects directly to Microsoft 365 email, Teams messages and files without requiring the material to be stored in an archive first. The product can retrieve relevant content as an investigation develops, rather than relying on manual export and staging before analysis begins.

This is intended to let investigators examine live workplace communications alongside archived records, data and logs. That broader view can help teams piece together events for regulatory, legal and internal reviews.

A second part of the announcement extends Proofpoint's Human Communications Intelligence, or HCI, agents into insider threat investigations. The agents bring interactions with copilots, generative AI applications and AI agents into the evidence organisations consider when assessing whether an employee action reflects routine work, a policy breach or harmful intent.

The expansion reflects a broader shift in workplace risk as generative AI tools become embedded in daily operations. Prompts, responses and exchanges with AI systems are increasingly treated as part of the communications record, particularly in sectors with strict record-keeping and compliance requirements.

Insider risk

Proofpoint argues that insider investigations now require more than conventional system alerts or access logs. By combining communications, behaviour and data activity, organisations may be better placed to understand why a potentially risky event occurred, rather than simply identifying that it happened.

For example, a prompt entered into an AI assistant may point to possible data exposure, but surrounding communications may show whether the action was part of normal work, a misunderstanding of policy or something more deliberate. That distinction is increasingly important for employers trying to avoid both underreaction and unnecessary escalation.

Harry Labana, Senior Vice President and General Manager, Digital Communications Governance, Proofpoint, set out the company's view of the challenge facing investigation teams.

"Security teams don't need another disconnected alert," said Harry Labana, Senior Vice President and General Manager, Digital Communications Governance, Proofpoint.

"While an alert can indicate what happened, it's communications intelligence that can explain the why. Like a cockpit voice recorder, it gives investigators more than a simple audio file, providing extensive details to piece together the events and intent behind them. By extending intelligence across Microsoft 365 and interactions with AI, we're bringing that same depth of context to security, compliance, and legal investigations."

Platform shift

The announcement also highlights how cybersecurity and compliance suppliers are adapting products for AI use in businesses. As staff rely more heavily on AI systems to draft content, answer questions and support decision-making, companies are under pressure to preserve those interactions as business records and monitor them for policy and regulatory concerns.

Proofpoint said the changes are part of a single platform spanning data and AI security, insider risk and digital communications governance. It presented this as an alternative to separate tools assembled for archiving, investigations and risk management.

For customers, the practical effect is an effort to bring several sources of evidence into one workflow. Microsoft 365 data remains central to many workplace investigations because email, collaboration messages and stored files often provide the main chronology of employee activity. AI interaction records add another layer, especially where workers use copilots or chat-based systems to handle sensitive information.

HCI agents are currently available as an add-on to Proofpoint Capture powered by Nuclei. Connectivity from Prism Investigator to Microsoft 365 is expected in the fourth quarter of 2026.