Proofpoint launches AI agent for monitoring workplace communications in real time

Proofpoint is putting a new spin on workplace monitoring. In September 2025, the cybersecurity firm introduced Human Communications Intelligence (HCI), a system built to scan conversations as they happen and flag potential risks before they grow into something larger.

The company frames HCI as a break from the old model of combing through emails and chat logs after the fact. By catching problems earlier, Proofpoint argues it can help organizations avoid the financial and reputational damage that often follows breaches or compliance failures. The same capabilities that promise faster detection also raise questions about privacy, oversight, and the risk of constant surveillance.

Accident or not, security incidents can be expensive

Collaboration platforms have quickly become the biggest headache for security chiefs. A survey of 1,600 global CISOs found that more than one-third view tools like Slack, Microsoft Teams, or Zoom as their top concern. These platforms ranked higher than generative AI chatbots, cloud storage, or Microsoft 365.

The data backs up the concerns. According to a 2024 report by Cybersecurity Insiders, 83 percent of organizations dealt with insider attacks in the past year. The 2025 Ponemon Institute Cost of Insider Risks Global Report found that the average organization experienced 13.5 insider-driven incidents in 2024. Many stemmed from mistakes rather than bad intent, but the costs add up fast. Lost data, regulatory penalties, and reputational harm leave businesses looking for tools that catch issues sooner.

State of Cybersecurity: Healthcare’s Tactical Defense Summit – Healthcare is under siege. This isn’t theory. It’s frontline reality. Join us on Oct. 14 for a half-day virtual summit focused entirely on immediate, actionable strategies to defend against today’s most pressing cyber threats. Learn more & Register.

Moving from keywords to intent

Proofpoint says HCI moves past older systems that just look for keywords or patterns. The new tool builds on technology from its 2025 acquisition of Nuclei and focuses on understanding intent. It can capture and analyze communications across more than 80 channels in real time, including email, messaging apps, collaboration platforms, file transfers, voice calls, social media, and even gen AI chatbots.

“Legacy connectors are merely proxies that pass content downstream, offering little intelligence,” said Harry Labana, senior vice president and general manager of Proofpoint’s Digital Communications Governance business. “Proofpoint has reimagined capture by moving beyond simply collecting messages to interpreting and reasoning in real time.”

Linking words and actions

HCI agents review conversations and explain why something gets flagged. The system can catch misconduct, regulatory violations, misuse of AI tools, insider threats, and even hints of toxic workplace culture. By explaining its reasoning, it gives compliance teams a clearer picture of risks, which Proofpoint says makes follow-up easier and more defensible.

The agents also connect with Proofpoint’s Insider Threat Management platform. This creates a feedback loop between communications and endpoint activity, linking what employees say with what they actually do on devices and networks. Proofpoint calls it the first system to combine communication-based risk detection with user activity in real time.

Regulators push for AI transparency

The launch comes as regulators call for stronger oversight of AI systems. In 2023, the U.S. National Institute of Standards and Technology released its AI Risk Management Framework, which emphasizes accountability, transparency, and fairness while addressing privacy and cybersecurity risks.

The growing focus on AI compliance is driving significant market growth. According to recent industry analysis, the global AI compliance monitoring market was valued at $1.8 billion in 2024 and is projected to reach $5.2 billion by 2030, growing at a compound annual growth rate of 19.4 percent. Organizations are increasingly using AI to automate compliance monitoring as digital communication becomes core to business operations.

Proofpoint says its emphasis on explainable AI is meant to address those concerns directly. By showing why a message was flagged, the company argues it can help compliance teams defend their decisions in industries where accountability is essential.

Turning down the noise

False positives have long frustrated security teams. Too many alerts create noise and obscure real problems. A 2024 Devo SOC Performance Report found that up to 53 percent of security alerts are false positives, and security teams spend over 25 percent of their time triaging them, according to research by the Ponemon Institute and Exabeam.

Proofpoint says HCI reduces false positives by up to 90 percent compared with older keyword-driven systems. A reduction that significant would make monitoring programs more efficient and less costly while helping analysts focus on complex cases that require human judgment.

AI could help close security gap as employee training lags

Proofpoint is introducing HCI in phases. The core agents powered by Nuclei are available now. New large language models will be added to the company’s Supervision product in Q4 2025. Integration with Insider Threat Management is set for Q1 2026. Customers in finance and healthcare are expected to adopt early, with broader rollout planned through 2026.

The new system reflects a broader industry push toward prevention. Ponemon reports that 81 percent of organizations already have or are building insider threat programs. Research shows that 48 percent of organizations reported an increase in insider threat incidents in 2024, with poor employee training cited as a major contributing factor.

Natural language processing is also becoming central to compliance. Recent research published in the Journal of Big Data shows transformer-based models have demonstrated exceptional performance in multilingual text processing, including code-mixed and cross-lingual communication. A 2025 analysis highlights models like mBERT and XLM-R, which allow businesses to process communications across multiple languages—critical as companies expand globally and depend on remote workforces.

Can company oversight and employee trust co-exist?

HCI may protect organizations, but it raises questions about employee surveillance. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) defines “insider threat” broadly, covering both intentional and unintentional acts. Companies must balance oversight with employee trust, a challenge heightened by hybrid work and cloud-based collaboration.

The debate is unlikely to fade. As more organizations adopt advanced monitoring, questions about data storage, consent, and oversight will shape deployment. Workers are also likely to push for more transparency around how these tools operate and how flagged data is used.

Intent detection as the next security frontier

Proofpoint’s tool highlights the move from reactive monitoring to predictive risk management. By combining communications analysis with endpoint activity, the company says HCI can give organizations a more complete view of potential threats and compliance risks.

Whether real-time monitoring becomes standard practice is uncertain. Proofpoint argues that understanding intent in everyday conversations is the next frontier in enterprise security, but companies who agree will need to find a balance between safety, compliance, and trust.