Most engineers think…
Most people picture email security as 'a spam filter that scans the message once and lets it through'. That mental model loses you the interview and gets users phished in production.
Proofpoint is a layered, people-centric system: the secure email gateway filters at the perimeter, Targeted Attack Protection (TAP) sandboxes risky URLs and attachments, URL Defense re-checks links at the moment of click — not just once at delivery — Email Fraud Defense with SPF/DKIM/DMARC stops impostors spoofing your domain, and Threat Response Auto-Pull (TRAP) can yank a message back out of inboxes after it was delivered. It also concentrates effort on the Very Attacked People (VAPs) — the specific humans attackers keep targeting.
① The secure email gateway flow — what happens before the inbox
When you put Proofpoint in front of email, your domain's MX record points at the Proofpoint Email Protection gateway, so every inbound message lands there before it ever reaches Microsoft 365, Google Workspace or on-prem Exchange. The gateway is the first filter, not the mailbox.
The inbound path, in order
First, connection reputation scores the sending IP at SMTP time and drops obvious botnet and bulk noise up front. What survives is scanned for spam and malware, then run through content filtering and rules (banned words, attachment types, encryption policy). Risky links and files are handed to TAP (next section). On the way out, the same gateway does outbound control: DLP on sensitive data and email encryption. One gateway, both directions.
After you point your MX at Proofpoint, what happens to an inbound email first?
② TAP & sandboxing — URL Defense and Attachment Defense
Targeted Attack Protection (TAP) is the advanced layer that handles what a simple filter cannot: weaponised links and malicious attachments. It analyses content in a sandbox and feeds verdicts to a TAP dashboard that shows who was targeted.
URL Defense — the part interviewers love
URL Defense rewrites every link in inbound mail to a Proofpoint URL. The crucial idea is time-of-click: when the user actually clicks, Proofpoint re-checks the destination at that moment and either allows it, blocks it with a warning page, or opens it in remote browser isolation if it is only suspicious. This beats a one-time delivery scan because attackers often weaponise a clean-looking link after the email is delivered.
Attachment Defense does the same for files: a suspicious attachment is held and detonated in the sandbox; clean files are delivered, threats are quarantined. Predictive sandboxing can detonate likely-bad URLs before anyone even clicks.
The perimeter filter mail hits first (MX points here): connection reputation, spam, malware, content rules and outbound DLP — both directions through one gateway.
Targeted Attack Protection — sandboxes risky URLs and attachments, detonating them in isolated environments and showing who was targeted on the TAP dashboard.
Rewrites every link and re-checks the destination at the moment of click (time-of-click); blocks bad pages, isolates suspicious ones in a remote browser.
Threat Response Auto-Pull — automatically retracts a message that turns malicious after delivery from every inbox, including forwarded copies.
In an interview, the differentiator is that URL Defense rewrites every link and re-evaluates the destination at the moment of click — not just once at delivery. That single phrase shows you understand why it catches links weaponised after the email arrives.
▶ Watch a phishing link get caught at the moment of click
How one rewritten link is re-checked end-to-end. Press Play for the healthy path, then Break it to see the classic failure.
A link is clean when the email is delivered but is weaponised an hour later. What stops the user?
③ Impostor, BEC and email authentication
Not every attack carries malware. BEC and impostor email rely on trust, so Proofpoint inspects sender identity, display-name tricks and look-alike domains, and applies email authentication.
The three authentication checks
SPF says which servers may send for your domain. DKIM cryptographically signs the message so tampering shows. DMARC ties the two together and tells receivers what to do when a message fails — none, quarantine or reject — and sends you reports. Email Fraud Defense is Proofpoint's service that guides you to a safe DMARC reject policy by finding every legitimate sender (including third parties) so you stop spoofers without breaking real mail.
The interview line: SPF/DKIM/DMARC stop spoofing of your domain; gateway sender analysis catches look-alike and display-name impostors. You need both.
DMARC only protects against spoofing of domains you own. It does nothing about a look-alike domain (paypaI vs paypal) or a malicious attachment. Pair DMARC/Email Fraud Defense with gateway sender analysis, TAP and TRAP — never sell DMARC as a complete answer.
Which control specifically stops attackers spoofing YOUR domain in the From address?
④ Remediate after delivery and prioritise the right people
No filter is perfect, and some links turn bad after delivery. Threat Response Auto-Pull (TRAP) closes that gap: when a message is judged malicious post-delivery, TRAP automatically retracts it from the inbox — even copies that were forwarded to other users — and quarantines them, in moments, without an admin touching each mailbox.
People-centric prioritisation
Proofpoint's signature idea is Very Attacked People (VAPs): instead of treating every user equally, it surfaces the specific humans attackers target most, plus risk signals like threats read before quarantine and permitted clicks. You then apply extra controls to VAPs — tighter URL isolation, training, stricter policies.
Deploy sanely: start in a monitoring posture, baseline who your VAPs are, wire TRAP for fast auto-pull, and move DMARC from none to reject only once Email Fraud Defense shows all legitimate senders pass.
Vivek at a Pune fintech faces this
Finance reports a 'CEO' email asking for an urgent vendor payment change; minutes later three staff confirm they received similar mail and one clicked a link.
An impostor used a look-alike domain for the display name, and the link was weaponised shortly after delivery so the delivery scan saw nothing.
The TAP dashboard shows the URL flipped to a malicious verdict post-delivery and lists exactly which users clicked; the senders are not authenticated for the real domain.
TAP Dashboard ▸ Threats + Threat Response ▸ Auto-PullFire TRAP to retract the message from every inbox including forwarded copies, block the look-alike domain, and move the real domain's DMARC toward reject via Email Fraud Defense; flag the clickers as VAPs for tighter controls.
Re-check the TAP dashboard: the message is gone from all inboxes, click attempts now hit the block page, and the spoofed domain fails authentication.
After a TRAP auto-pull, confirm in Threat Response and the TAP dashboard that the message left every inbox (including forwards) and that click attempts now hit the block page. Don't close the incident on 'should be gone'.
Why does Proofpoint highlight Very Attacked People (VAPs)?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why is URL Defense 'time-of-click' stronger than scanning a link once at delivery? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Email Protection (secure email gateway)
- Proofpoint's gateway that your MX points at — filters inbound reputation, spam, malware and content, and applies outbound DLP and encryption before mail reaches the mailbox.
- Targeted Attack Protection (TAP)
- The advanced layer that sandboxes weaponised URLs and attachments and shows who was targeted on the TAP dashboard.
- URL Defense
- Rewrites every link in inbound mail and re-checks the destination at the moment of click (time-of-click), blocking or isolating malicious pages.
- Time-of-click
- Re-evaluating a link's destination when the user actually clicks, not just once at delivery — catching links weaponised after the email arrives.
- Attachment Defense
- Holds a suspicious attachment and detonates it in a sandbox; clean files are delivered and threats quarantined.
- Email Fraud Defense
- Proofpoint's service that simplifies SPF/DKIM/DMARC and guides you safely to a DMARC reject policy to stop spoofing of your domain.
- DMARC
- An authentication policy built on SPF and DKIM that tells receivers whether to allow, quarantine or reject mail that fails, and sends reports.
- Threat Response Auto-Pull (TRAP)
- Automatically retracts a message that turns malicious after delivery from every inbox, including forwarded copies, and quarantines it.
- Very Attacked People (VAP)
- The specific users attackers target most; Proofpoint surfaces them so you can apply extra controls, isolation and training.
- BEC (Business Email Compromise)
- A fraud where an attacker impersonates an executive, vendor or colleague to trick someone into payments or data — often with no malware at all.
📚 Sources
- Proofpoint — Email Security Service / Core Email Protection product page. proofpoint.com/us/products/email-protection
- Proofpoint — Targeted Attack Protection (TAP) data sheet: URL Defense, Attachment Defense, predictive sandboxing & browser isolation. proofpoint.com
- Proofpoint — Email Fraud Defense: SPF, DKIM & DMARC against impostor/BEC threats. proofpoint.com/us/products/email-protection/email-fraud-defense
- Proofpoint — Threat Response Auto-Pull (TRAP): automatic post-delivery retraction. proofpoint.com/us/products/email-protection/threat-response-auto-pull
- Proofpoint Newsroom — Redefining Email and Data Security for the Agentic Workspace (unifying SEG & API), March 2026. proofpoint.com/us/newsroom
- Proofpoint — What Is DMARC? (threat reference) and Email Protection best-practice articles (M365 inbound/outbound integration). proofpoint.com
What's next?
Got Proofpoint email security? Next, see how the same people-centric model extends to insider risk and data loss prevention across cloud apps — and how security awareness training closes the human gap.