Proofpoint vs Abnormal: gateway and API approaches compared

How the options were evaluated

Originally compared on 12 August 2026; selected deployment, package and pricing statements were rechecked against first-party captures on 13 October 2026.

• Deployment: what changes in DNS or in the tenant before mail is inspected.
• Visibility: which messages and which signals the product reads once it is live.
• Disposition: what happens to a message the product decides is malicious.
• Commercial evidence: what each vendor states about price on its own pages.
• DMARC scope: whether domain authentication is included, sold separately, or absent.

A capability counts as available only inside the scope the vendor states. Silence on a page is a question for the demo, not proof that something is missing.

The gateway path: Proofpoint in the mail path

With a secure email gateway, the domain owner configures MX records to route inbound mail through the gateway before the mailbox provider. Coverage depends on the routing configuration; mail that bypasses the gateway requires separate controls. See Proofpoint product documentation.

Proofpoint Core Email Protection supports API and secure email gateway deployment. Its current page describes Microsoft Graph integration, API deployment without MX changes, and inline policy enforcement through a gateway. Compare mail-flow coverage, remediation permissions and rollout requirements for the configuration you are buying; the deployment labels alone do not establish identical detection results. See Proofpoint product documentation.

Deploying the gateway configuration costs you a DNS change with live mail behind it. Repointing MX is the moment mail flow depends on the new vendor, and backing out is another DNS change.

Coverage depends on how mail is routed and which platform permissions are granted. Proofpoint Core Email Protection advertises post-delivery removal of malicious emails as well as inline gateway protection. Confirm internal-message coverage, rescan behavior and forwarded-copy remediation for the chosen deployment. See Proofpoint product documentation.

Proofpoint's buying page names four enterprise packages, Core, Tier 2, Tier 3 and Prime, with no figure against any of them. Its dated published price sheets cover the Essentials line, and the sheets cover different dates, regions, package sets and currencies: a US sheet stamped 10/21 and an EMEA sheet stamped 5/22 with a different package set and different currency columns. Both are dated records, not a rate card.

The API path: Abnormal beside the mail platform

Abnormal’s inbound email security page advertises API deployment in 60 seconds with no MX changes. Its platform page lists native API integrations across Microsoft 365, Google Workspace, Okta and CrowdStrike, plus SIEM and SOAR integrations.

That position buys a different field of view. Abnormal states it reads identity, behavioral and content signals per message, and names authentication events, calendar activity and internal threads as sources a gateway cannot access. Its stated method is a per identity baseline: a behavioral fingerprint for every employee and vendor, so a sender is measured against that person's own history rather than a population average. The attack class it names is payload free business email compromise, which can pass sender-authentication checks.

Microsoft's documentation is a useful reference point for what behavioral detection means. It describes implicit email authentication as adding sender reputation, sender history and behavioral analysis on top of SPF, DKIM and DMARC. Its policy documentation then defines four phishing thresholds that set machine learning sensitivity, and states that false positives rise as the setting goes up.

The limit of the API position is timing. The product acts on mail the platform has already accepted, so its remedy is removal rather than refusal. Abnormal says threats are removed before users engage, and publishes a Search and Respond function that remediates in bulk. How wide that window runs is a trial question. The reviewed Abnormal pages do not list enterprise pricing. Abnormal claims its product plus native protection can replace a gateway; validate that claim against your own coverage and remediation requirements.

The contrast does not map cleanly onto the two names, though. A buyer who cannot touch MX can deploy Proofpoint by API and land in the same position as Abnormal, including the loss of edge blocking. The gateway comes from one of these vendors; the API model comes from both.

How DMARC management differs from inbound filtering

DMARC does not cover lookalike-domain or display-name impersonation. A lookalike domain can authenticate its own messages while impersonating a trusted organization. See RFC 9989 §2.2. Those threats need additional detection and identity controls: Proofpoint Email Fraud Defense, for example, advertises lookalike-domain detection. Evaluate the relevant detection coverage separately from exact-domain DMARC enforcement.

DMARC sender authentication and inbound filtering are separate control layers. Proofpoint includes Email Fraud Defense as a core component of Collaboration Security Prime and advertises hosted SPF, DKIM and DMARC. Confirm the quoted product, package and DNS responsibilities. For Abnormal, verify any proposed DNS or authentication management directly rather than inferring it from an API deployment.

Palisade operates the domain-authentication layer. Its Domain Overview documentation describes sender findings and detection/remediation tasks. Palisade’s agent prepares remediation and proposed DMARC policy changes for human approval. For a comparison with Proofpoint’s consultant-led authentication offering, see the Proofpoint DMARC alternative.

How to choose

Take the deployment constraint first, because it rules out more than any feature does.

• If you can change MX and want inline enforcement before mailbox delivery, evaluate Proofpoint’s gateway configuration. Confirm support for your mailbox platform and required mail flows.
• If MX changes are unavailable, evaluate the API deployments both vendors advertise and confirm their inspection coverage and permissions.
• If the losses you actually see are payload free impersonation of people your staff already trust, rather than malware and credential pages, weight the per identity behavioral model against your own recent misses.
• If both describe you, run the API product beside the platform's built in filtering for a month and count what it catches that the platform missed. That is the only number here that comes from your tenant.

Confirm whether hosted SPF, DKIM and DMARC are included in the quoted package, what each component costs, and who approves and implements DNS changes. See Proofpoint product documentation.

Evidence

Sources and further reading

• Proofpoint Core Email Protection
• Proofpoint Email Protection deployment options
• Proofpoint Collaboration Security buying options
• Proofpoint Essentials EMEA price list, stamped 5/22
• Proofpoint Email Fraud Defense
• Abnormal inbound email security
• Abnormal platform integrations
• Microsoft anti-phishing protection in Defender for Office 365
• Microsoft anti-phishing policies and thresholds
• RFC 9989, Domain-based Message Authentication, Reporting, and Conformance (DMARC)
• Palisade documentation