In short: Proofpoint Essentials is a cloud email security gateway for small and mid-sized organisations. Mail is routed through Proofpoint by an MX change, which filters spam, phishing and malware before it reaches Microsoft 365 or another mail platform. Higher packages add encryption, data loss prevention, email continuity and a ten-year cloud archive. It is licensed per user.
What Proofpoint Essentials is
Proofpoint is one of the long-established names in email security, and Proofpoint Essentials is its multi-tenant cloud service for smaller organisations. It works as a secure email gateway: all inbound and outbound mail for your domains passes through Proofpoint, which removes spam, phishing and malware on the way in and checks outbound mail on the way out.
Because it sits in front of your mail platform, it works the same way with Microsoft 365, Google Workspace and on-premises Exchange. There is no hardware or software to install. Administrators get a web console with message logs and policy settings, and users receive a quarantine digest so they can release legitimate mail themselves.
How it works with Microsoft 365
Moving to a gateway is a mail-flow change, so it is worth doing methodically:
- Add and verify your domains in Proofpoint Essentials, and sync users from Microsoft Entra ID or Active Directory so licences match real mailboxes
- Configure inbound and outbound policies, quarantine settings and any encryption or DLP rules
- Create Microsoft 365 connectors for mail from and to Proofpoint, and add Proofpoint to your SPF record
- Change your MX records to point at Proofpoint
- Lock Exchange Online down so it only accepts inbound mail from Proofpoint, closing the route attackers use to bypass a gateway
- Review quarantine and user feedback for the first weeks and tune policies
Exchange Online Protection keeps running behind the gateway. Settings in Microsoft 365 need care so the two do not double-quarantine or reject each other's mail; we handle that as part of the switch. If you would rather not change MX records at all, an API-based product such as IRONSCALES is the alternative approach; our email security hub compares the two architectures.
Packages and features
Proofpoint Essentials is sold in Business, Advanced and Professional packages, each with a plus version (Business+, Advanced+ and Professional+). Packages build on each other: filtering is in every package, and encryption, data loss prevention, continuity and archiving come in as you move up. Proofpoint revises package contents from time to time, so we confirm exactly which package includes which feature against your requirements when we quote.
| Feature | What it does |
|---|---|
| Spam and phishing filtering | Proofpoint's MLX machine-learning engine analyses headers, structure, content, sender reputation and images |
| Multi-layer anti-virus and zero-hour outbreak protection | Signature and heuristic scanning, plus automatic protection against brand-new outbreaks |
| Content and outbound filtering | A rules engine for message policies, scanning of all outbound mail, message trace and disclaimers |
| URL Defense and Attachment Defense | Proofpoint Targeted Attack Protection technology that analyses links and files built to evade ordinary filters |
| Email encryption | Policy-based encryption, triggered automatically, by a subject-line tag or from an Outlook button |
| Email data loss prevention | Built-in dictionaries and smart identifiers, plus custom policies |
| Continuity | Email spooling, Emergency Inbox and Instant Replay |
| Archiving | Ten-year cloud archive with search, eDiscovery and retention policies |
External recipients of encrypted mail read and reply through Proofpoint's Secure Mail web portal, while internal users read encrypted mail in their normal inbox. Security awareness training is available as a per-user add-on, and our sister site covers security awareness training in depth.
Continuity and archiving
Two features set a gateway such as Proofpoint Essentials apart from API-only products:
- Email continuity: if your mail service has an outage, email spooling holds incoming mail and delivers it when service returns, and the Emergency Inbox switches on automatically so users can read, reply to and download attachments from queued mail. Instant Replay lets users replay delivered messages from the last 30 days that were deleted by mistake
- Archiving: packages that include archiving add a ten-year cloud archive with real-time journaling from Microsoft 365 and Exchange, search and eDiscovery, retention policies and an audit log of archive searches, useful for regulated firms and for answering subject access requests and disputes. Historical mail can be imported, licensed per gigabyte
An archive is not the same as a backup. If you need to restore deleted mailboxes, SharePoint and OneDrive, see Microsoft 365 backup.
Proofpoint and Hornetsecurity
Proofpoint completed its acquisition of Hornetsecurity on 8 December 2025, and Hornetsecurity now operates as a business unit within Proofpoint under the Hornetsecurity by Proofpoint brand. Its Microsoft 365 suite is promoted as Proofpoint 365 Total Protection, in four plans that step up from filtering and encryption to advanced threat protection, archiving and continuity, then backup, and finally awareness training, permission management and DMARC. It is built specifically for Microsoft 365, and Hornetsecurity describes a hybrid mode that combines pre-delivery and post-delivery protection.
Proofpoint's website now leads with 365 Total Protection for smaller organisations, but Proofpoint Essentials remains available to order and existing customers continue to run on it. If you are choosing between the two, the deciding factors are usually whether you want backup in the same subscription and whether you prefer a gateway or an API connection. We can quote both: see Proofpoint Essentials licensing and 365 Total Protection licensing.
Who it suits
Proofpoint Essentials suits organisations from a handful of staff to a few hundred that want:
- A proven gateway in front of their mailboxes, independent of the mail platform
- Encryption, DLP, continuity and an archive from one supplier and one console
- Simple per-user licensing that follows starters and leavers
It is less suited to organisations that want to avoid MX changes, or whose main concern is attacks shared through Teams, SharePoint and other collaboration apps, where an API-based product sees more. Compare the alternatives in Defender for Office 365 vs Harmony Email & Collaboration and our Perception Point guide.
How we help
We size the package against your needs, set up domains and user sync so shared mailboxes are not licensed unnecessarily, build policies, make the MX and connector changes out of hours and lock down Exchange Online so the gateway cannot be bypassed. We also publish SPF, DKIM and an enforced DMARC policy. Pricing depends on the package and user count: ask us for a quote.
Contact us to discuss Proofpoint Essentials.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Proofpoint Essentials work with Microsoft 365?
Yes. Proofpoint Essentials sits in front of Microsoft 365 as a cloud gateway. You point your MX records at Proofpoint, create connectors in Exchange Online and restrict Microsoft 365 to accept inbound mail only from Proofpoint.
What is the difference between Proofpoint Essentials Business, Advanced and Professional?
The packages build on each other. Business is the entry package, built around spam, phishing and malware filtering with content and outbound filtering. The higher packages add features such as encryption, data loss prevention, continuity and archiving. Each has a plus version with further capabilities, and Proofpoint revises contents from time to time, so we confirm the current feature list when we quote.
Is Hornetsecurity part of Proofpoint?
Yes. Proofpoint completed its acquisition of Hornetsecurity on 8 December 2025. Hornetsecurity's Microsoft 365 suite is now promoted as Proofpoint 365 Total Protection, while Proofpoint Essentials continues as a separate product.
Does Proofpoint Essentials include email archiving?
Yes, in the packages that include archiving: a ten-year cloud archive with search, eDiscovery and retention policies. Historical email can be imported into it, which is licensed per gigabyte.
How is Proofpoint Essentials licensed?
Per user, billed on the users on your account. Archive imports are licensed per gigabyte and security awareness training is a per-user add-on. Ask us for a quote.