Proofpoint ships 35-second exploit protection for zero-days

Proofpoint launched Active Exploits Protection on July 28, a system that converts observed exploit activity into network-wide defenses in roughly 35 seconds, with full propagation in under 18 minutes. The product targets the shrinking window between vulnerability disclosure and active exploitation, a gap the company says has collapsed from years to hours as AI models accelerate exploit discovery.

The core pitch: patching cannot keep pace with machine-speed threats. Active Exploits Protection sidesteps the patch cycle by layering detection and blocking across email and network paths, drawing from Proofpoint's telemetry across 3 million organizations and 14,000 large enterprises.

What does Active Exploits Protection actually do?

The product monitors Proofpoint's global sensor network, which spans over 5,000 endpoints and processes more than 2 billion emails daily. When that network detects exploit activity against a vulnerability, the system automatically generates and pushes protective rules to customers. Proofpoint claims 99.999% detection precision.

Four capabilities anchor the release. First, it prioritizes vulnerabilities based on observed attacker behavior rather than CVSS severity scores. Second, it translates exploit intelligence into protection in approximately 35 seconds. Third, it exposes that intelligence via APIs for integration with SOC tools and automation pipelines. Fourth, it provides a foundation for AI-driven security workflows that reduce manual triage.

Why the patch cycle no longer works

Proofpoint's argument rests on a timing mismatch. Frontier AI models can now discover software vulnerabilities autonomously, compressing the window between disclosure and weaponization. In some cases, attacks begin before public tracking frameworks like CISA's KEV catalog reflect the risk.

"The speed at which threats are evolving has fundamentally changed the risk equation," said CEO Sumit Dhawan. "It's no longer enough to identify vulnerabilities. Organisations need to understand what attackers are exploiting in real time and reduce their exposure immediately."

The company positions this as an escape from "vulnerability overload." Fewer than 6% of all disclosed vulnerabilities are ever observed being exploited in real-world attacks, yet security teams face thousands of critical-rated alerts. Active Exploits Protection filters that noise by grounding prioritization in actual attacker behavior.

The gap between claim and proof

Proofpoint's 35-second-to-protection claim is impressive if validated. The company has not released independent benchmarks or third-party audits of that latency. The 99.999% precision figure also lacks published methodology. Security teams evaluating the product should request customer references and false-positive data before committing.

Pricing and packaging were not disclosed. The product is available globally via integrated platform capabilities and API access, but whether it requires an existing Proofpoint subscription or sells standalone remains unclear.

Where this fits in the stack

Active Exploits Protection is not a replacement for vulnerability management or endpoint detection. It layers on top, feeding intelligence into existing SOC tools and automation pipelines like Zapier or n8n for teams building custom security workflows. The API access positions it as a data source for AI-driven security operations, not a standalone platform.

The product is available now. Whether it delivers on the latency claims will depend on real-world deployment data that Proofpoint has not yet published.

Source: TahawulTech.com / Daniel Shepherd