Most engineers think…
Most people assume email security is a gateway that blocks known-bad files and URLs at delivery. Miss it once and it's over.
Proofpoint TAP breaks that model. URL Defense rewrites every link so TAP can evaluate it the moment a user clicks — even if that URL was clean when the email arrived and turned malicious an hour later. Attachment Defense detonates files in a cloud sandbox before they reach the inbox. And predictive URL Defence pre-sandboxes suspicious links based on email-traffic patterns, so TAP can block a phishing URL before anyone clicks at all. The Threat Insight Dashboard ties it all together with campaign-level forensics.
① What Proofpoint TAP is — people-centric, not perimeter-centric
Traditional email gateways block known malware signatures at the perimeter. Proofpoint TAP (Targeted Attack Protection) is built around the idea that people are the target, not just the network. TAP tracks which users receive threats, which are most targeted (VAPs), and what threat families are being weaponised against them.
TAP sits inside the Proofpoint email security stack and adds two active defence layers — URL Defense (rewriting and time-of-click analysis) and Attachment Defense (sandbox detonation) — plus predictive URL Defence that pre-analyses suspicious links before any click. Every verdict feeds the Threat Insight Dashboard for campaign-level forensics.
What distinguishes Proofpoint TAP from a standard email gateway?
② URL Defense — rewrite, time-of-click & predictive analysis
URL Defense rewrites every URL in inbound email, replacing the original link with a Proofpoint proxy URL. When the user clicks, the proxy fetches the destination in a real-time cloud sandbox, scores the page and either passes the click through or blocks it with an interstitial warning — all within milliseconds. This catches time-of-click threats: URLs that were benign at delivery but turned malicious by the time a user clicks hours or days later.
Predictive URL Defence
Predictive URL Defence goes further: TAP analyses email-traffic patterns and sandboxes suspicious URLs before any user clicks, flagging links that share infrastructure or behaviour patterns with known campaigns. If the pre-sandbox verdict is malicious, the rewritten URL is blocked the moment anyone clicks, even on the first recipient. This closes the gap between delivery and the first click — the window where most zero-hour phishing succeeds.
TAP replaces every link in inbound email with a Proofpoint proxy URL so that clicks can be evaluated in real time, catching URLs that turn malicious after delivery.
When a user clicks a rewritten URL, TAP sandboxes the destination in milliseconds and blocks it with a warning if the page is now malicious — even if it was clean at delivery.
TAP analyses email-traffic patterns and sandboxes suspicious URLs before any user clicks, using infrastructure and behavioural signals to catch zero-hour phishing proactively.
Suspicious files are routed to the Proofpoint Nexus cloud sandbox, executed in isolation and watched for malicious behaviours. Malicious verdicts quarantine the message before it reaches the inbox.
URL rewriting is not itself the protection — it is the mechanism that lets TAP re-evaluate the destination the moment someone clicks. Without the rewrite, TAP has no hook at click time. Always explain these as two separate things in an interview: the rewrite (delivery-time) and the time-of-click sandbox (click-time).
A phishing URL was clean when the email arrived but redirected to a credential harvester two hours later. Which TAP feature catches it when a user finally clicks?
③ Attachment Defense — Nexus sandbox detonation
Attachment Defense routes suspicious attachments to the Proofpoint Nexus cloud sandbox for detonation before the message is delivered. The sandbox executes the file in an isolated environment, watches for malicious behaviours (network callbacks, registry changes, process injection, file drops), and returns a verdict: clean, suspicious or malicious. Clean files are delivered normally; malicious files are quarantined and an alert is raised.
TAP uses a combination of static analysis, dynamic detonation and threat-intelligence lookups so that known-bad files are caught quickly and novel samples go through full detonation. The attachment analysis is also correlated with URL Defence — a document containing an embedded URL that detonates maliciously triggers both attachment and URL verdicts, giving analysts the full attack chain in one forensic record.
A common misconception is that sending every attachment to a sandbox introduces unacceptable delays. Proofpoint TAP uses static analysis and threat-intel lookups for known-bad files (fast path) and only routes genuinely ambiguous files through full dynamic detonation. Most clean attachments are released within seconds, not minutes.
▶ Watch a phishing email get neutralised end-to-end
Step through how TAP handles a credential-phishing email with a rewritten URL. Press Play for the healthy block path, then Break it to see the classic bypass.
What is the Proofpoint Nexus sandbox used for in TAP?
④ Threat Insight Dashboard — campaigns, forensics & VAPs
The TAP Threat Insight Dashboard is the single pane that ties every TAP verdict into campaign-level intelligence. It shows which users were targeted (including VAPs), the threat family (phishing, malware, BEC), attack screenshots, forensic indicators (IPs, domains, payload hashes), and campaign timelines. You can drill from a campaign down to every affected mailbox in the organisation.
Integrations and SIEM export
The dashboard exposes a SIEM API that streams TAP events into Splunk, Microsoft Sentinel or any compatible platform. TAP also integrates with Proofpoint TRAP (Threat Response Auto-Pull) to automatically retract malicious messages already delivered — closing the loop from detection to remediation without manual analyst action.
Priya at a Mumbai-based fintech firm faces this
Several employees report clicking a link in what looked like an IT helpdesk email. The link appeared safe at delivery but later redirected to a credential harvester. TAP URL Defense is deployed but the security team is unsure how to assess the damage.
The phishing URL used a redirect chain that was inactive at delivery time — defeating the MTA scan — and only armed two hours after the email landed in inboxes.
Open the TAP Threat Insight Dashboard ▸ search the rewritten URL ▸ view campaign tab to see all users who clicked. Check forensic indicators for the redirect domain and landing page.
Threat Insight Dashboard ▸ Campaigns ▸ URL forensics ▸ Impacted usersRetract remaining unclicked copies with Proofpoint TRAP. Block the landing-page domain in the web gateway. Reset credentials for every user who clicked. Verify that predictive URL Defence is enabled to catch similar redirect chains before the first click next time.
Re-check the Dashboard: the campaign is marked contained, no further clicks recorded, and impacted users have been remediated with new credentials.
Before raising a P1 incident, open the Threat Insight Dashboard and check the campaign view. It will tell you exactly how many users were targeted, how many clicked, the full forensic chain (IPs, domains, payload hashes) and whether TRAP has already retracted copies. This single read eliminates most of the guesswork in an email-threat triage.
An analyst needs to see every user who received a specific phishing campaign and the full attack forensics in one view. Where in TAP does this information live?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why does TAP rewrite URLs at delivery rather than just scanning them once and being done? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- URL Defense
- The TAP feature that rewrites every inbound URL with a Proofpoint proxy link, enabling real-time sandboxing at the moment of each user click.
- Time-of-Click Protection
- TAP re-evaluates a rewritten URL in a cloud sandbox the moment a user clicks — catching URLs that were clean at delivery but turned malicious later.
- Predictive URL Defence
- TAP proactively sandboxes suspicious URLs based on email-traffic patterns and infrastructure signals before any user click, closing the zero-hour phishing window.
- Attachment Defense
- TAP routes suspicious attachments to the Proofpoint Nexus cloud sandbox for static analysis and dynamic detonation before delivery; malicious files are quarantined.
- Nexus Sandbox
- Proofpoint's cloud-based detonation environment that executes suspicious files in isolation and watches for malicious behaviours such as network callbacks and process injection.
- Threat Insight Dashboard
- The TAP web interface showing campaign-level forensics, impacted users (VAPs), attack screenshots, forensic indicators and SIEM-exportable event data.
- Very Attacked Person (VAP)
- A user who receives a disproportionate share of targeted attacks, surfaced by TAP in the dashboard to guide prioritised security controls.
- TRAP (Threat Response Auto-Pull)
- A Proofpoint capability that automatically retracts malicious messages from all affected mailboxes when TAP raises an alert, completing the detect-and-remediate loop.
📚 Sources
- Proofpoint — Targeted Attack Protection data sheet. proofpoint.com/sites/default/files/proofpoint_tap-datasheet-a4.pdf
- Proofpoint UK — Targeted Attack Protection product page: URL Defense, Attachment Defense, predictive analysis. proofpoint.com/uk/products/advanced-threat-protection/targeted-attack-protection
- Proofpoint Legal — Data Privacy Information Sheet: Targeted Attack Protection. proofpoint.com/us/legal/trust/targeted-attack-protection
- University of Washington IT — Proofpoint Targeted Attack Protection URL Defense guide. it.uw.edu/guides/email-calendaring/protecting-your-email/proofpoint-target-attack-protection/
- Proofpoint Help — SIEM API documentation for TAP Threat Insight Dashboard. help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/SIEM_API
- Proofpoint — Resolving TAP Alerts with Threat Response Auto-Pull (TRAP) data sheet. proofpoint.com/sites/default/files/pfpt-us-ds-tap-alerts.pdf
What's next?
Got TAP covered? Next, explore Proofpoint TRAP (Threat Response Auto-Pull) to see how TAP alerts trigger automatic quarantine of already-delivered malicious messages across the whole org.