Proofpoint has introduced the industry’s first unified agentic system to bridge the gap between AI and data security. Built on the Proofpoint Knowledge Graph, the system employs autonomous agents to detect risks, automate investigations, and optimise protection in real time. By translating business intent into automated runtime controls, organisations can safely deploy AI agents while maintaining strict data governance across both human and autonomous activities.
AI agents now discover, access, transform, and act on sensitive data at a scale no manual review can match. AI tools often see intent but not data access, and data tools see sensitive data but not agent intent. As those interactions multiply, seeing only half the picture leaves critical risk unseen. Securing AI and data separately is no longer enough; it takes a system that can act as fast as the risk appears.
Additionally, AI governance now extends beyond data loss. Agents can interact with enterprise systems, make decisions, and execute transactions, creating financial, operational, compliance, and safety risks. Proofpoint’s 2026 AI and Human Risk Landscape report found that 87% of organizations have moved AI assistants beyond pilot, yet 52% aren’t confident their controls could detect a compromise. Security teams now need to define and enforce AI behavior in real time.
“You cannot secure AI without securing the data it acts on, and you cannot secure data without understanding how AI is using it,” said Mayank Choudhary, executive vice president and general manager, Data Security and Governance Group, Proofpoint. “Intent and access are two sides of the same coin. Securing them separately leaves critical context behind. Bringing AI run-time protections and AI data governance together gives organizations that context, and the ability to act on risk at the speed AI now moves.”
One Agentic System for AI
The agentic system reasons at the agent level, using the same identity, access, and data context that already secures more than 14,000 enterprises’ data today. It is built on the Proofpoint Knowledge Graph, which is the foundation, connecting AI activity with data sensitivity, identity, access, behavior, and intent through Nexus models. On top of it, three new agents work from one shared understanding of risk instead of three partial ones:
- Zero-Touch Detection: The Detection Agent sees intent and access as a single signal, surfacing the handful of actions that matter instead of the flood of anomalies traditional tools can’t stop generating.
- Instant Investigation: The Investigation Agent reconstructs what happened across data, identity and behavior automatically, turning an investigation that once took days of manual correlation into minutes.
- Protection Optimization: The Remediation Agent turns that understanding into action, from access remediation to DLP policy optimization, with a human in the loop for governance.
Deepening AI Runtime Security: Turning Business Intent into AI Runtime Controls
Organizations need to enforce the rules they’ve already set for how AI should behave and catch the risks they never thought of writing a rule for in the first place.
Proofpoint Semantic Business Policies translate existing governance requirements into continuously enforced AI controls. An organization can take a rule already written into its code of conduct, such as prohibiting interactions with gambling content, and express it in plain language: “Do not allow interactions with gambling content.” Proofpoint interprets the intent behind the policy, identifies the systems capable of carrying it out, and generates the runtime controls to enforce it automatically. Combined with Proofpoint Intent-Based Access Control, these policies evaluate AI behavior against both enterprise requirements and an agent’s intended purpose, whether an employee is acting through an AI assistant or an autonomous agent is acting on their behalf at AI speed.
Finding the Risks Enterprises Have Not Yet Defined
Agentic Insights uses autonomous reasoning agents to analyze AI interactions, tool usage, policy decisions, and behavioral patterns to uncover emerging risks. When a risk is validated, Proofpoint can recommend a Semantic Business Policy to govern similar behavior, turning new intelligence into enforceable protection.
Across AI and data security workflows, purpose-built detection, investigation, and remediation capabilities turn connected context into autonomous action, while Semantic Business Policies and Agentic Insights keep pace with risks the organization hasn’t defined yet. Together, they prioritize real risk, speed investigations with data, identity, access, and behavioral signals, and reduce exposure through actions like access remediation, DLP policy optimization, and enforceable runtime controls to cut manual work as AI activity scales.
“Organizations have spent decades defining how their businesses should operate,” said Ryan Kalember, chief strategy officer, Proofpoint. “The challenge now is making those rules enforceable as AI takes on more consequential work. Business intent needs to become part of the security control itself, with the ability to identify new risks and adapt as AI behavior evolves.
