Cohort 1 · SAT-led legacy

Verified 2026-04-28 · Decays 2027-04-28

Objection · 01

We have Proofpoint, we'll use their awareness training.

Validate

Acknowledge it. Using what is already in the stack means lower overhead and a single vendor relationship. The reasoning is sound for the email channel specifically.

Reframe

The architectural question is signal universe. Proofpoint's signal layer is email, fed by TAP telemetry. Behavioural risk outside email – identity, endpoint, data, collaboration – is outside their view.

Ask

What about the risk that does not come through email – credential exposure, data handling, collaboration tool risk?

Proof · Stat

VAP is fed by Targeted Attack Protection email telemetry. It cannot see behaviour outside the inbox – the framework's structural ceiling is the signal source.