Item: Proofpoint Threat Response Auto-Pull
Rating: 9
Author: Chris Bash

Use Cases and Deployment Scope

TRAP is being used across our whole organization. We use it in conjunction with PPS, TAP, and PSAT with CLEAR. It saves us about 5 - 10 hours per week quarantining emails and evaluating user-submitted emails. We have auto-response templates set up so that user-submitted emails will automatically be replied to with the verdict of their submission.

Pros and Cons

It will automatically pull malicious emails from users' mailboxes if they are not detected first by PPS.
It will evaluate user-submitted suspect phishing emails and reply to the users with the result of the evaluation.
It will pull emails from users per an admin-submitted CVS file of emails we want to pull.
It informs admins of the status of its email investigations.

Would like an Azure virtual machine version of it. Currently, it's only supported on VMware and AWS.
Configuring authentication certificates on it is not easy.
It does not work with RSASSA-PSS signed certificates.

Return on Investment

Saves email admins approximately 10 hours per week from manually investigating and pulling malicious emails.
With auto-response templates, it teaches users how to better react to suspicious emails.
If one user submits a malicious email, it will auto pull the same email from the others affected users. That's great for preventing further outbreaks.

Alternatives Considered

Microsoft Exchange

TRAP had fewer false positives and caught more malicious emails. With the host of companion products, it was more complete package. It gives us the ability to pull emails using an admin-submitted CVS file of emails to pull. EOP does not have this capability.

Key Insights

Do you think Proofpoint Threat Response Auto-Pull delivers good value for the price?

Yes

Are you happy with Proofpoint Threat Response Auto-Pull's feature set?

Yes

Did Proofpoint Threat Response Auto-Pull live up to sales and marketing promises?

Yes

Did implementation of Proofpoint Threat Response Auto-Pull go as expected?

Yes

Would you buy Proofpoint Threat Response Auto-Pull again?

Yes

Other Software Used

Proofpoint Advanced Threat Protection, Proofpoint Cloud App Security Broker (Proofpoint CASB), Proofpoint Email Protection, Proofpoint Security Awareness Training (formerly Wombat Security)

Usability

It's easy to use and requires very little administrator hands on.

Support Rating

They are quick to respond and have talented support personnel.

Likelihood to Recommend

If your email admins spend time manually pulling malicious emails, this tool will save them countless hours of work and will do it for them 24 x 7. So if a user receives a malicious email after-hours, TRAP will auto pull it from the affected user's mailbox and potentially save you from an IT disaster.

Very happy with my TRAP appliance

Overall Satisfaction with Proofpoint Threat Response Auto-Pull