Proofpoint, Inc., a leading cybersecurity and compliance company, launched Active Exploits Protection, a new solution that empowers organisations to defend against the growing exposure to AI-accelerated cyber threats.
Based on real-world threats observed across Proofpoint’s telemetry, it identifies vulnerabilities actively abused in the wild and automatically translates that intelligence to enable immediate protection across the primary attack paths.
Advanced AI models, including frontier systems capable of autonomously discovering software vulnerabilities, are dramatically increasing the speed at which they are discovered and weaponised. The patch cycle is no longer the security clock, with time-to-active targeting collapsing from years to a matter of hours or less. In some cases, attacks begin before public tracking frameworks reflect the risk. Traditional, patch-based security approaches cannot keep pace with this machine-speed threat environment.
Deep intelligence grounded in real-world exploitation
Proofpoint’s advantage is rooted in dual-source visibility into how vulnerabilities are actually abused—often before they are reflected in public risk frameworks. Proofpoint’s attack telemetry spans hundreds of millions of daily email interactions, complemented by a global network of more than 5,000 sensors, that have generated over three million exploit-related alerts in 2026 alone. Year to date, Proofpoint has identified 12 actively exploited 2026 CVEs compared to eight currently listed in CISA’s Known Exploited Vulnerabilities (KEV) catalogue. Active Exploits Protection operationalises this intelligence, translating real-world malicious activity into prioritised remediation and immediate protection.
“The speed at which threats are evolving has fundamentally changed the risk equation”, said Sumit Dhawan, CEO of Proofpoint. “It’s no longer enough to identify vulnerabilities. Organisations need to understand what attackers are exploiting in real time and reduce their exposure immediately. By combining real-world exploit intelligence with protections across the primary attack paths, we can help defend at the speed today’s threats spread”.
From vulnerability overload to exploitation clarity
Even as vulnerability volumes surge, with frontier AI accelerating discovery at scale, fewer than 6% of all disclosed vulnerabilities are ever observed being exploited in real-world attacks. Security teams are left drowning in “critical” findings, forced to triage thousands of alerts without clear signals about what materially increases risk. Organisations often find themselves allocating resources based on severity scores rather than actual attacker behaviour.
Active Exploits Protection helps organisations move beyond patch velocity toward real-time exposure reduction. Grounded in observed attacker activity, the solution enables security teams to focus remediation on what materially reduces risk, shrink the window between vulnerability discovery and defence, and stop exploit-driven threats before they disrupt the business. To help organisations operationalise this approach, Active Exploits Protection delivers four core capabilities:
- Prioritise Actively Exploited Vulnerabilities: Identifies vulnerabilities confirmed to be used in the wild based on Proofpoint telemetry across more than 3 million organisations and 14,000 large enterprises. Prioritisation is driven by observed attacker behaviour, not theoretical severity scoring, enabling security teams to focus remediation on what materially reduces risk.
- Enable Immediate Protection: Exploit intelligence is automatically translated into protection in approximately 35 seconds, with network-wide propagation in under 18 minutes. This reduces the exposure window for zero-day and newly weaponised threats to a median of minutes, even when patching hasn’t started. Across more than two billion emails analysed daily, the platform maintains 99.999% detection precision.
- Faster, Threat-Informed Decisions: Turning intelligence directly into action, Active Exploits Protection shortens the time between threat identification and protection deployment, provides real-time context for investigations, and enables customers to access and tailor attack intelligence via APIs. The solution integrates with existing SOC tools, vulnerability management platforms, and automation pipelines.
- Scale with AI-Driven Workflows: Designed for modern security operations, the solution provides a foundation for AI-driven and automated workflows. By embedding exploit intelligence directly into operational processes, organisations can reduce manual triage and operationalise exposure reduction at scale.
Proofpoint Active Exploits Protection is available globally today and delivered via integrated platform capabilities and API access.
Image Credit: Proofpoint
Source: Tahawul Tech