Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)

What it does

Proofpoint Satori is Proofpoint's set of AI agents for security operations, built on its email, collaboration and data security platform. Satori runs multi-step workflows it calls 'missions' that use Proofpoint telemetry, apply guardrails, act where permitted and log every decision. The Satori Abuse Mailbox Agent works in the Threat Protection Workbench as an autonomous analyst. It processes every abuse-mailbox submission routed through CLEAR that is labelled 'Needs Manual Review', labels each one phish, malware, spam or clean, and can trigger the customer's remediation workflows to quarantine or tag messages. Analysts can ask it about its decisions in a chat interface. 'Memories' (global patterns plus local, natural-language instructions from the team) tune its future behaviour. Per the datasheet, the agents do not carry out enforcement such as blocking, deleting or changing policy, and high-risk alerts are escalated to humans. The Satori DLP Triage Agent triages data loss prevention alerts. Satori MCP Access lets the agents exchange context with other tools such as Microsoft Copilot and CrowdStrike Charlotte. Tessian, which Proofpoint acquired, now redirects to Proofpoint. Pricing is not published. On 15 Oct 2026 Proofpoint and Varonis announced a definitive agreement for Proofpoint to acquire Varonis in an all-cash transaction valued at about $6.3 billion, expected to close in the first half of 2027 subject to shareholder and regulatory approvals; until then the companies operate independently.

Frameworks (vendor-stated)

No framework tags yet.

Pricing (as published)

Not published as list prices. The Abuse Mailbox Agent datasheet describes an action-based model (pay for automated work performed, not users, tokens or seats) without dollar amounts.

Tasks

phishing triageemail securityalert triagesecurity operations

Sources

1. proofpoint.com/us/platform/satori (primary)
2. proofpoint.com/sites/default/files/data-sheets/pfpt-us-ds-satori-abuse-mailbox-agent.pdf
3. proofpoint.com/sites/default/files/data-sheets/pfpt-us-ds-satori-dlp-agent.pdf
4. proofpoint.com/us/contact
5. proofpoint.com/us/tessian-is-now-proofpoint
6. proofpoint.com/us/newsroom/press-releases/proofpoint-acquire-varonis-creating-global-leader-data-and-ai-security

Last verified 19 Oct 2026. Framework tags indicate relevance, not certification; “vendor-claimed” items are as marketed by the vendor. Spotted an error? Submit a correction or email [email protected]. See our methodology.

Use-case comparisons

• Email security and phishing-response AI agents — 16 verified listings (Triage of user-reported phishing, autonomous email threat remediation and AI-run phishing simulation)

Compare Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent) with

• 
  7AI agentic security platform vs Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)
• 
  Abnormal AI Security Mailbox (Abnormal AI for Government) vs Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)
• 
  Adaptive Security Agentic Email Security and Phish Triage vs Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)
• 
  Aikido Attack AI Pentesting vs Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)
• 
  AIpentix (agentic continuous security testing and agentic red teaming, by Swipergy) vs Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)
• A
  Andesite Human-AI SOC (Azimuth for Government) vs Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)
• 
  Anomali Agentic AI in ThreatStream Next-Gen and the Anomali Data Lake (autonomous triage, scoring and investigation agents) vs Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)
• 
  AppOmni Marlin AI (autonomous SaaS and agentic-AI risk investigation) vs Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)
• 
  Arctic Wolf Aurora Agentic SOC (Swarm of Experts agents) vs Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)
• 
  Ares Cyber agentic AI security testing platform (autonomous exploit chaining and runtime verification across SAST, SCA, DAST, VA and pentest) vs Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)

Alternatives

• 
  7AI agentic security platform — Boston-based agentic security platform where swarms of specialised AI agents categorise, investigate and reach a determination on every alert, escalating only what needs a person, with optional managed service (PLAID ELITE).
• 
  Abnormal AI Security Mailbox (Abnormal AI for Government) — Autonomous agent for email security operations that triages user-reported emails, removes related malicious campaign messages across the organisation and replies to reporters; included in Abnormal AI for Government, which is FedRAMP and GovRAMP Moderate authorized.
• 
  Adaptive Security Agentic Email Security and Phish Triage — API-based 'agentic email security' that re-analyses inbound mail after native filtering with ML and LLM reasoning and removes confirmed threats across every inbox automatically (configurable human-in-the-loop thresholds). AI Phish Triage classifies employee-reported emails and acts on them, feeding Adaptive's simulations and awareness training.
• 
  Aikido Attack AI Pentesting — Belgian autonomous AI pentest: many agents map the app, test attack paths and re-exploit each finding to confirm it, with a same-day audit-grade report.
• 
  AIpentix (agentic continuous security testing and agentic red teaming, by Swipergy) — German continuous security-testing platform with an AI agent that signs in to the customer's application on its own, chooses follow-up checks and documents attack paths, with every tool run evidenced. Findings are grouped into remediation actions with owners, deadlines and Jira sync, and retests confirm fixes. Agentic red-team campaigns (recon, access, lateral and report agents led by human red teamers) are also offered for TIBER-EU and DORA TLPT style testing.
• A
  Andesite Human-AI SOC (Azimuth for Government) — Agentic SOC platform with configurable agents for alert triage, enrichment, investigation and remediation under analyst oversight; its government offering is FedRAMP High authorized.

See all Proofpoint Satori agents alternatives →

FAQ (from this dataset)

What does Proofpoint Satori agents do?

Agentic AI layer inside Proofpoint's platform. The Satori Abuse Mailbox Agent classifies every user-reported email that needs manual review (phish, malware, spam or clean) and can trigger configured quarantine or tagging workflows. A DLP Triage Agent does the same for data-loss alerts, with guardrails, chat explanations and audit logs.

How much does Proofpoint Satori agents cost?

Not published as list prices. The Abuse Mailbox Agent datasheet describes an action-based model (pay for automated work performed, not users, tokens or seats) without dollar amounts.

Where is Proofpoint headquartered?

United States

What are alternatives to Proofpoint Satori agents?

See the Proofpoint Satori agents alternatives page for category-sharing listings in relevance order, not a ranking. Proofpoint Satori agents alternatives.

Stay updated