AI Governance & Security Vendor Wiki

7 min read

Proofpoint

One-liner — Thoma Bravo-owned email-security incumbent’s data-security line: Proofpoint DSPM (built from the acquired startup Normalyze), which discovers and classifies sensitive data across cloud/SaaS/on-prem and puts a dollar value on the risk, and Proofpoint Enterprise DLP across email, cloud, endpoint and GenAI tools. Its AI-security line (ex-Acuvity) has its own page, acuvity.

Categories — dspm; also listed in dlp for Proofpoint Enterprise DLP (see below).

What it does

Proofpoint DSPM (formerly Normalyze) is Data Security Posture Management: it scans data stores across SaaS, PaaS, public/multi-cloud, on-prem and hybrid, discovers and classifies sensitive data, maps who/what can access it, and surfaces the riskiest exposures. Normalyze’s differentiator was in-place scanning (no copying data out) and quantified, dollar-value risk scoring to prioritize remediation; Proofpoint pitches the combined product as protecting data “while prioritizing the reduction of human-centric risks.” The job: know where regulated/sensitive data is and whether it is over-exposed — including to AI tools and RAG pipelines.

Naming / provenance

Founded 2020 as Normalyze; acquired by Proofpoint (announced 2024-10-29). The standalone brand is retired: as of 2026-07-27, normalyze.ai 301-redirects to a “Normalyze is now Proofpoint” page and the product is sold as Proofpoint Data Security Posture Management. Page slugged by product (like prisma-airs) because “Proofpoint” alone is ambiguous — Proofpoint also owns acuvity (shadow-AI/agent visibility, acquired 2026-02) and its core email-security/DLP franchise.

Where it sits in the stack

Data layer, dspm. Risk focus: sensitive data — find and reduce sensitive-data exposure before AI systems can reach it. Posture/visibility, not an inline runtime control. Adjacent to dlp (Proofpoint’s core) and data-access-governance.

Proofpoint Enterprise DLP (cross-listing to DLP)

Added 2026-10-24, prompted by an October 2026 CTO survey write-in under DLP (Q52, “Proofpoint”, 1 respondent, in production). This page is the wiki’s single Proofpoint data-security page, so Proofpoint’s DLP product is recorded here rather than on a separate Proofpoint page.

Proofpoint Enterprise DLP is Proofpoint’s core DLP product and is older than the DSPM. Per Proofpoint’s product page (vendor marketing, checked 2026-10-24), it covers email, cloud apps (Microsoft 365, including Teams, OneDrive and SharePoint), endpoints (USB transfers, web uploads, file-movement tracking) and AI tools, with alerts triaged in a single console. Its GenAI claim (marketing; no mechanism detail on the page) is detection and control of sensitive data in GenAI prompts and uploads, including unsanctioned tools. The 2024-05-01 “DLP Transform” release described the approach in more detail: allow or disallow GenAI interactions based on user behaviour, content and data lineage rather than blocking the tools outright. That release also said a browser extension for text typed into ChatGPT and Gemini was “expected … end of Q2 2024”; whether it shipped was not verified on this pass. Email DLP is the historical strength. Adaptive Email DLP, built on the acquired Tessian behavioural engine, went GA in 2024 and catches misdirected email and exfiltration by email. In September 2025 Proofpoint packaged DSPM, DLP, insider-threat management and data lineage together as Data Security Complete (launched Q3 2025), and announced AI Data Governance for sanctioned and unsanctioned AI use. Agent and MCP controls are sold separately (see acuvity). CTO lens: a strong fit where Proofpoint already runs email security, since email DLP and the DSPM come under one vendor. Against cyberhaven or nightfall-ai, the GenAI prompt controls are unproven: ask in a POC whether prompt inspection depends on the browser extension, and how it treats desktop AI apps.

Deployment & architecture

SaaS console with agentless, in-place scanning of connected data stores via cloud APIs/roles. Integrates with cloud providers and security tooling. Now folded into the Proofpoint platform alongside Proofpoint DLP.

Positioning & differentiators

Known for in-place scanning and quantified risk (“data risk in dollars”). Nearest neighbors: cyera, sentra, bigid, securiti, concentric-ai, bedrock-data, and wiz (DSPM-as-CNAPP-module). The pitch is no longer standalone DSPM but “DSPM + DLP + human-centric security” in one Proofpoint platform.

Ownership, funding & M&A

Verified (acquirer matches seed). Normalyze acquired by Proofpoint; announced 2024-10-29, expected to close November 2024; financial terms not disclosed. Brand fully absorbed by 2026 (redirect verified 2026-07-27). Note the chain of ownership: Proofpoint is itself owned by Thoma Bravo (taken private 2021), so this is effectively a Thoma Bravo-portfolio asset under Proofpoint — Proofpoint’s first data/AI-security buy, followed by acuvity (2026-02). Founded 2020 (San Francisco); co-founders Amer Deeba (CEO, ex-Qualys) and Ravi Ithal (CTO, ex-Netskope/Palo Alto); ~$26.6M raised (Series A $22.2M, June 2022, Battery Ventures + Lightspeed). Ownership confidence high on the acquirer; deal terms remain undisclosed.

CTO / hedge-fund lens

Day-1 if you handle regulated/sensitive data and especially if doing RAG (you must know where sensitive data sits before exposing it to AI). For an existing Proofpoint customer, the value is consolidation — DSPM under the same vendor as email security/DLP. For others, evaluate it against the data-first specialists (cyera, sentra) as a Proofpoint platform module, not a standalone tool — the standalone product and brand are gone.

Competitors / alternatives

cyera, sentra, bigid, securiti, concentric-ai, bedrock-data, wiz, microsoft-purview.

Open questions / to verify

  • Independent confirmation of the actual close (press treated it as completed by Dec 2024; a standalone “completion” PR was not located).
  • Deal price (undisclosed).
  • How Proofpoint DSPM is packaged/priced relative to the former standalone Normalyze offering.
  • Enterprise DLP: did the ChatGPT/Gemini browser extension (promised end Q2 2024) ship, and how does prompt inspection work for desktop AI apps? Is Enterprise DLP sold standalone or only inside Data Security Complete?

Sources

History

  • [2026-06-28] Stub created from seed registry (as normalyze).
  • [2026-06-28] Researched; verified Proofpoint acquisition (announced 2024-10-29, expected close Nov 2024, terms undisclosed), raised ownership_confidence low→high; noted Proofpoint→Thoma Bravo ownership chain; filled founding/HQ/funding. Open: independent close confirmation.
  • [2026-07-27] Renamed page normalyze → proofpoint-dspm (user-flagged; verified normalyze.ai 301-redirects to Proofpoint and product is sold as Proofpoint DSPM). Brand-survival open question resolved: brand retired.
  • [2026-10-24] Cross-listed to dlp and added a Proofpoint Enterprise DLP section (channels, GenAI prompt claims marked as marketing, Data Security Complete 2025), triggered by a 1-respondent in-production write-in under DLP in the October 2026 CTO survey. Kept as one Proofpoint data-security page rather than creating a duplicate Proofpoint vendor page.
  • [2026-10-24] Set acquisition.closed to null: 2024-10-29 was the announcement date and no completion release has been found (ownership_state stays acquired-closed because the brand is fully absorbed).
  • [2026-10-24] Slug renamed proofpoint-dspm → proofpoint (user request): the page now covers both Proofpoint DSPM and Enterprise DLP, so it is the company page. Inbound links and survey-v2.csv Wiki URLs updated. Acuvity stays a separate page.
  • [2026-10-24] Frontmatter ownership re-pointed to the company: Thoma Bravo take-private (closed 2021-08-31). Normalyze’s founding year, HQ (2020, San Francisco) and pre-acquisition funding (~$26.6M; Series A $22.2M, 2022-06) moved here from frontmatter; Proofpoint’s own founding/HQ not yet verified.

Graph View

Backlinks