Proofpoint Insider Threat Management (ITM)

As described on AWS Marketplace.

Proofpoint Insider Threat Management (ITM) gives security teams visibility into the risky behavior that leads to business disruption, data loss, and revenue impact - whether it stems from careless mistakes, malicious intent, or compromised accounts. The platform delivers a full picture of user activity through an easy-to-follow timeline that captures the who, what, when, and where of insider actions, while out-of-the-box detection rules help teams quickly flag risky behavior among their highest-risk users. This context-driven approach matters because modern, distributed workforces give employees, contractors, and third parties access to more data than ever, while organizational shifts like mergers, acquisitions, and restructuring, along with geopolitical and economic pressures, heighten the risk of insider-driven theft, fraud, espionage, and sabotage.

At the core of ITM is its ability to turn ambiguous alerts into clear, actionable evidence. Detailed behavioral data, including optional screen captures, provides irrefutable evidence of whether a user's actions were careless, compromised, or malicious, and built-in privacy controls help reduce investigator bias while supporting compliance requirements. Investigations often extend beyond the security team alone, resolving insider-driven alerts frequently involves HR, compliance, legal, and line-of-business managers, and ITM's tagging, workflow, and cross-functional collaboration features, along with the ability to export activity records as PDFs and other common formats, help these teams coordinate efficiently. A single, unified console lets teams set policies, triage alerts, hunt for threats, and respond to incidents in one place, minimizing the time and cost of drawn-out investigations.

Highlighted by the publisher on AWS Marketplace.

Insider risk visibility: Timeline view reveals the who, what, when, and where of risky behavior from careless, malicious, or compromised users.

Irrefutable evidence: Detailed activity data, with optional screen capture, speeds investigations and cross-functional collaboration with HR and legal.

Lightweight endpoint agent: Fast, low-friction deployment that monitors risky users without disrupting productivity or conflicting with other tools.

As stated by the publisher on AWS Marketplace.

All orders are non-cancellable and all fees and other amounts that you pay are non-refundable. If you have purchased a multi-year subscription, you agree to pay the annual fees due for each year of the multi-year subscription term.