Microsoft Defender for Identity vs. Proofpoint Advanced Threat Protection

Microsoft Defender for Identity is a great solution for each company that has an Active Directory. It fills in the blanks for Identity related incidents that are being missed in the XDR platform. To get a full view on identity risks it is an essential component

It is great out of the box and uses AI and machine learning to identify threats with minimal input. It does need to be configured and tuned to meet the needs of the organisation. Industry specific software that sends or receives emails may be affected by this product.

Incentivized

• detect threats and suspicious activities
• pro-active measurements on possible breaches
• identity security posture

• Spam filtering.
• Automatic retrieval of malicious emails that have gotten through the filter but were later detected using sample data across all the organizations Proofpoint has as customers.

Incentivized

• setup can be complicated, with AD complexity
• Sometimes the load on DCs is pretty high, leading to performance issues
• Better tuning options for preventing false-positive/bening alerts

• With our current setup we need to add new users manually.
• Reports aren't that intuitive.
• Mailboxes have to be removed manually.

Incentivized

Proofpoint offers a lot of products, but they are not particularly well integrated. They all look different, and there is no central location to access them all from, which is disappointing. However, I do know they have a big push for upgrading the UI and usability, so this should improve in the coming months I hope.

Incentivized

Even though the product is good, the support can be lacking at times. The support needs to know their product inside and out, but there are times in which we figure out things before their support does. I feel as if we should not be able to fix issues that their support cant fix, hence the main reason for support.

Incentivized

Microsoft Defender for Identity is more specialized on the Identity platform, it is a single solution compared to a multi-solution. The integration is better when using the XDR suite in combination with Sentinel. Microsoft Defender for Identity gives a better overview of the security posture

Proofpoint's Advanced Threat Protection, in the past, has identified threats whereby Microsoft's Advanced Threat Protection did not.

Incentivized

• Cost impact was pretty high
• Learning curve, needed time (money) for training
• Greatly improved detections and gives more insights

• PP blocks 5-10 emails per day which are spam or malicious
• I only get a small number of emails per week which are spam
• The only malicious emails I receive are from our internal security team which bypasses the PP threat protection

Incentivized