Praxis Navigator + Proofpoint: Measure Behavior Beyond the Threats

Proofpoint protects your people from threats and delivers security awareness training through ZenGuide, backed by one of the deepest threat-intelligence datasets in the industry. Praxis Navigator adds a different layer: independent, read-only evidence of whether employees are actually behaving more securely day-to-day. This page shows what Proofpoint's reporting can tell you, what it can't, and how the two combine to produce the behavioral evidence DORA, NIS2 and GDPR now ask for.

Proofpoint: Enterprise Threat Protection and Security Awareness

Proofpoint is one of the world's leading cybersecurity companies, a trusted partner to 80+ of the Fortune 100 with an integrated suite of email security, data loss prevention, and compliance solutions. The platform analyses 3.4 trillion emails every year, giving it one of the deepest threat intelligence datasets in the industry.

Source: Proofpoint (Why Proofpoint) · Verified July 2026

What Proofpoint delivers:

Email threat protection — Advanced detection and blocking of phishing, business email compromise, malware, and account takeover attacks across the email gateway
ZenGuide (Security Awareness Training) — Adaptive, risk-driven training with the DICE framework (Detect, Intervene, Change, Evaluate), nano- and micro-learning modules, and AI-powered phishing simulations based on real threat intelligence
People Risk Explorer — Risk scoring that evaluates users based on their roles, behaviors, attack exposure, privileges, and vulnerability to generate individual Human Risk Scores
Data Loss Prevention — Detection and prevention of accidental and malicious data loss across email, cloud, and endpoints
Compliance and archiving — Enterprise communications retention, supervision, and compliance management
Threat-informed simulations — AI ThreatFlip Workflow that converts real-world threats into phishing templates with a single click

Proofpoint is particularly well-suited for large enterprises that need a comprehensive, integrated security platform spanning email protection, training, DLP, and compliance — all informed by deep threat intelligence.

What Proofpoint's reporting can't show

Proofpoint measures the threats reaching the user extremely well. What it does not measure is what the user does with everything that is not a threat.

Proofpoint's reporting shows:

Which threats were blocked at the email gateway
Who clicked on simulated phishing and how click rates trend over time
Individual Human Risk Scores based on roles, training results, attack exposure, and DLP alerts
Who completed training modules and how they performed on assessments
Which users triggered data loss prevention policies

Proofpoint's reporting can't show:

How employees handle file sharing across SharePoint and OneDrive day-to-day
Whether collaboration behaviors in Teams are becoming more or less secure
How MFA adoption and identity hygiene are trending across the organization
Whether a specific training campaign or policy change produced measurable behavioral improvement in daily Microsoft 365 usage
What your organization's security culture looks like as a quantified, trackable metric over time

People Risk Explorer scores risk based on signals within Proofpoint's own ecosystem — email gateway events, DLP triggers, phishing simulation results, and training activity. It's a powerful view, but it's the view from Proofpoint's platform. It can't see what employees do inside Microsoft 365 when no threat is present and no simulation is running.

That's the difference between risk scoring from security events and behavioral monitoring from daily work. See the difference between activity metrics and behavioral evidence.

Peer-reviewed field research

29–55%

of the variation in phishing susceptibility is attributable to organizational-level factors, not individual ones.

Measured across 83,269 employees in 510 organizations, using their real responses to phishing campaigns.

Petrič, G., & Roer, K. (2022). The impact of formal and informal organizational norms on susceptibility to phishing. Telematics and Informatics, 67, 101766. Licensed under CC BY 4.0.

Read the research

What Proofpoint reports — and what DORA still asks for

Proofpoint's financial-services footprint makes DORA the most relevant regime here. DORA and its peers ask for evidence of the human layer's effectiveness, not just the technical control — a different measurement, read from a different place.

What Proofpoint reports — and what DORA still asks for
What your reports show	What the regulation asks for	What closes the gap
Threats blocked at the email gateway and phishing-simulation click rates	DORA Art 13(4) and 13(6) — regularly monitoring and testing the effectiveness of the digital operational resilience strategy, including staff awareness	Behavioral evidence of whether the workforce is handling risk more safely over time
Individual Human Risk Scores calculated from Proofpoint's own signals	NIS2 CIR Annex §7 — the effectiveness of risk-management measures, technical and organizational, must be evaluated	An independent behavioral baseline, not bounded to any single vendor's event stream
DLP policy triggers and compliance archiving records	GDPR Art 32(1)(d) — a process for regularly testing, assessing and evaluating effectiveness	A continuous behavioral trend across email, file sharing, collaboration and identity

Proofpoint's reporting evidences the technical control and the training program. DORA and its peers ask for evidence of the human layer's effectiveness too — a different measurement, read from a different place.

See what DORA asks you to evidence

How Praxis Navigator measures it instead

Praxis Navigator connects to your Microsoft 365 environment via the Graph API and monitors actual employee security behaviors across five data sources: Exchange Online, SharePoint, OneDrive, Teams, and Entra ID. Instead of measuring threats blocked or training completed, Praxis Navigator measures what employees do — every day, in their normal work.

Behavioral baselines — how employees handle security before any intervention, calculated from historic Microsoft 365 data available from day one
20+ behavior indicators — real security behaviors across email, file sharing, collaboration, and identity management
Intervention tagging — tag when you roll out a ZenGuide campaign, update a Proofpoint policy, or make any other change
Before/after comparison — automatic behavioral comparison showing whether each intervention produced measurable change
Security culture scoring — quantified culture maturity metrics based on the Security Culture Framework adopted by ENISA
Stakeholder reports — board-ready evidence that your security investments are working

Setup takes 15 minutes. No agents, no endpoint software, no data export. See how the platform works.

How Proofpoint and Praxis Navigator work together

Baseline — Connect Praxis Navigator to Microsoft 365 and see your current behavioral baseline.

Protect & Train — Proofpoint blocks threats at the gateway while ZenGuide delivers targeted training.

Tag — Tag ZenGuide campaigns, Proofpoint policy changes, or any other intervention in Praxis Navigator.

Compare — See automatic before/during/after behavioral comparison.

Prove — Generate stakeholder reports showing whether the program is producing measurable behavior change.

Need to build the business case? Calculate your security training ROI — free, no email required.

Feature comparison

How Proofpoint and Praxis Navigator divide the work
Capability	Proofpoint	Praxis Navigator	Together
Email threat protection	Yes	—	Proofpoint blocks threats
Simulated phishing campaigns	Yes	—	Proofpoint tests awareness
Security awareness training (ZenGuide)	Yes	—	Proofpoint delivers training
Data loss prevention	Yes	—	Proofpoint prevents data loss
Human Risk Scoring (event-based)	Yes	—	Proofpoint scores risk from platform signals
Compliance and archiving	Yes	—	Proofpoint manages compliance
Microsoft 365 behavior monitoring	—	Yes	Praxis measures real daily behavior
Behavioral baseline from historic data	—	Yes	Praxis provides an instant baseline
Intervention impact measurement	—	Yes	Praxis proves what worked
Published pricing, self-serve signup	—	Yes	Praxis is buyable without a sales call
Dedicated environment per customer	—	Yes — dedicated Azure	No pooled tenant data
Evidence independent of the training platform	No	Yes	Measurement that survives a vendor change
Setup time	Days to weeks	15 minutes	Praxis operational alongside existing Proofpoint deployment

Proofpoint is an enterprise security and training platform; Praxis Navigator is a behavior monitoring platform. They serve different functions in a security program.

Pricing you can see

Our prices are published. Use the calculator, see your number, start a trial — no sales call, no qualification, no quote request. Most platforms in this category will not tell you the price without a meeting first.

See the price

Questions security leaders ask

Is Praxis Navigator a replacement for Proofpoint?

No. Praxis Navigator does not provide email security, threat protection, training content, DLP, or compliance tools. It monitors actual employee security behaviors in Microsoft 365. Organizations use Praxis Navigator alongside Proofpoint to add a behavioral measurement layer that proves whether the overall security program — including Proofpoint's training and threat protection — is producing real behavioral change.

Doesn't People Risk Explorer already measure behavior?

People Risk Explorer generates Human Risk Scores based on signals within Proofpoint's ecosystem: training results, phishing simulation performance, DLP policy triggers, attack exposure, roles, and privileges. These are valuable risk indicators. Praxis Navigator measures something different: how employees actually behave across the full Microsoft 365 environment — file sharing patterns, collaboration behaviors, identity management, email handling — regardless of whether a threat event or simulation triggered the observation. People Risk Explorer tells you who is at risk based on security events. Praxis Navigator tells you how the entire workforce behaves day-to-day.

We're already invested in the full Proofpoint suite. Why add another tool?

Proofpoint is excellent at protecting, training, and scoring risk. What it can't do is show your CISO or board a before-and-after behavioral comparison proving that the investment is changing how employees work. Praxis Navigator provides that evidence layer. It answers the question Proofpoint's dashboards aren't designed to answer: "Is the workforce measurably more secure than it was six months ago?"

Does Proofpoint's People Risk Explorer satisfy DORA's requirement to test resilience effectiveness?

Partly, for the technical layer. DORA Art 13(4) and 13(6) require financial entities to regularly monitor and test the effectiveness of their digital operational resilience strategy, including staff awareness of the human layer. People Risk Explorer's Human Risk Scores are calculated from signals inside Proofpoint's own platform — training results, phishing simulations, DLP triggers — which evidences engagement with Proofpoint's program rather than an independent measure of how the workforce behaves in daily work. Praxis Navigator reads that evidence from Microsoft 365, independent of Proofpoint.

How does Praxis Navigator get behavioral data?

Praxis Navigator connects to Microsoft 365 via the Graph API with read-only access. It monitors security-relevant behaviors across Exchange Online, SharePoint, OneDrive, Teams, and Entra ID. No data is exported or stored outside your environment — Praxis uses a zero-storage architecture for maximum data privacy.

How quickly can I see results?

Within 15 minutes of connecting your Microsoft 365 tenant, you'll see your first Employee Pulse with behavioral data. Because Microsoft retains historic activity data, you get a behavioral baseline from day one — no need to wait weeks or months to start measuring.

Does Praxis Navigator work with other security platforms besides Proofpoint?

Yes. Praxis Navigator is platform-agnostic. It works alongside any security or training solution because it measures behaviors in Microsoft 365, not within any vendor's platform. You can tag interventions from any source — ZenGuide campaigns, KnowBe4 modules, policy changes, awareness events, or anything else — and measure the behavioral impact.

Who built Praxis Navigator?

Praxis Navigator is built by Praxis Security Labs, founded by Kai Roer. Roer is the author of Build a Security Culture and co-author of The Security Culture Playbook (Wiley). He created the Security Culture Framework, which has been adopted by ENISA and is used by organizations worldwide to measure and improve security culture.

Already using Proofpoint?

Connect Praxis Navigator to your Microsoft 365 in 15 minutes and see whether your Proofpoint investment is actually changing how employees work.

Start your free 30-day trial

No credit card. No commitment. Results in 15 minutes, or don't continue.

See the price — published, no sales call required.

Read what DORA requires — resilience testing must cover the human layer, not just the technical one.

Related comparisons

Praxis Navigator + KnowBe4

Measure the impact of the world's largest security awareness training platform.

Praxis Navigator + MetaCompliance

Add behavioral measurement to a European human risk management platform.

Praxis Navigator + Microsoft 365

Measure the people inside the tenant Microsoft already secures.

Compare every platform category

See what each kind of platform measures, and what none of them measure, in one place.