Healthcare · Managed platform (Proofpoint)

Email Security

Protect executives and patient data from phishing and impersonation, with Proofpoint run by Moraph

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs Proofpoint email security for hospitals, health systems and other healthcare organizations. We configure Proofpoint to filter malicious mail, flag messages that impersonate your executives or vendors, and remove dangerous messages after delivery, and our analysts triage what your staff report. Proofpoint provides the platform; Moraph operates it; your organization decides the policies and whether any incident is a reportable breach.

The problem it solves

Email is still the most common way attackers reach a healthcare organization. Messages that pose as the CEO asking the CFO for an urgent wire, a vendor announcing new bank details, or an IT notice asking a nurse to sign in again are written to get past people, not just filters. Small security teams often own a capable email platform but lack the time to tune impersonation rules, work the queue of reported messages, pull a bad message from every mailbox it reached, and keep evidence for a breach assessment.

  • Executives and finance staff are targeted with impersonation messages that carry no malware for a filter to find
  • Reported phishing messages sit in a shared mailbox without anyone triaging them
  • A malicious message found after delivery has to be found and removed from every mailbox by hand
  • When patient data may have been exposed, the evidence for a breach assessment is scattered

Who uses it

  • CISOs and information security teams at hospitals and health systems
  • CFOs, finance and accounts payable teams who handle payment and banking requests
  • HIPAA privacy officers who assess possible breaches
  • Messaging and Microsoft 365 or Google Workspace administrators
  • Internal audit and compliance teams who need evidence of email controls

Requirements it supports

HIPAA Security Rule (45 CFR Part 164, Subpart C)HIPAA Breach Notification Rule (45 CFR 164.400-414)HITECH ActHealth Industry Cybersecurity Practices (HICP), Section 405(d) of the Cybersecurity Act of 2015HHS Healthcare and Public Health Cybersecurity Performance GoalsNIST SP 800-177 Rev. 1, Trustworthy Email

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Proofpoint provides and supports the email security platform, Moraph configures and runs it for you, and your organization owns the mail system, the policies and the decisions about breaches and people.

AreaMoraphProofpointYour organization
LicensingResells Proofpoint licences sized to your mailboxes and modules, and tracks renewalsSets licence terms and entitlementsApproves the licence scope and the mailboxes covered
Platform availabilityMonitors mail flow through Proofpoint and raises platform issues with ProofpointOperates the Proofpoint service under its own service commitmentsRuns your mail system, such as Microsoft 365, Google Workspace or Exchange
Policy configurationBuilds and tunes filtering, impersonation, tagging and encryption rules, and documents every versionProvides the filtering engines, threat intelligence and policy optionsDecides the protected executives, the strictness of each policy and what is quarantined
Mail routing and DNSSpecifies the routing, connector and SPF, DKIM and DMARC changes neededProvides the routing endpoints and setup guidanceMakes changes to your mail system and DNS records
Identity and accessConfigures administrator and analyst roles in the Proofpoint console and links them to your directoryProvides the role model in the platformDecides who may see message content and quarantined mail
Monitoring and triageTriages reported and flagged messages, removes confirmed malicious mail and blocks senders under the agreed runbookClassifies messages and supplies threat dataReceives escalations and decides on actions beyond the runbook
Incident responseProvides message records, recipients and click data to your response teamSupports platform defects through its own support channelDecides whether an event is a breach and makes any patient, HHS or media notification
ChangesTests policy changes and applies them after approvalChanges the product under its own release termsApproves policy changes and new protected people
Platform updatesReviews Proofpoint release notes and adjusts configuration where updates affect your policiesPublishes updates to the serviceApproves configuration changes that follow an update
User supportAnswers your service desk on quarantine releases, blocked messages and reported phishingSupports Moraph on product issuesRuns your service desk and staff awareness communications

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Proofpoint itself, which belongs to its vendor.

  1. Step 1

    Onboarding tracker

    Onboarding is tracked step by step, with each task's owner, so routing and DNS changes on your side are visible.

    TaskOwnerStatus
    Domains and mailboxes confirmedYour security ownerDone
    Directory connection configuredMoraph engineerDone
    Inbound routing switched to ProofpointYour messaging adminIn progress
    Protected-people list approvedYour security ownerWaiting
    Report button deployedYour messaging adminNot started
    DMARC plan agreedMoraph engineerNot started
    Onboarding is tracked step by step, with each task's owner, so routing and DNS changes on your side are visible.

  2. Step 2

    Policy baseline review

    Before go-live, Moraph walks your security owner through the policy baseline and records the decisions still open.

    Policy baseline · Example Health System (fictional)

    Domains in scope
    3
    Mailboxes in scope
    4,820
    Protected people
    14 proposed
    External sender banner
    On
    Lookalike domain action
    Quarantine
    DMARC policy today
    None (monitor only)

    Decisions needed

    • Approve the protected-people list
    • Confirm finance mailboxes for payment-request warnings
    • Agree which quarantine folders staff may release from
    Before go-live, Moraph walks your security owner through the policy baseline and records the decisions still open.

  3. Step 3

    Change request

    Policy changes go through a request, a test and your approval before Moraph applies them.

    CR-1182 · Add two vendor lookalike domains to quarantine rule

    1. Change requested after a vendor impersonation attemptYour finance lead
    2. Rule drafted and tested against recent mailMoraph engineer
    3. No legitimate messages would have been heldMoraph engineer
    4. Change approvedYour security owner
    5. Change applied and version recordedMoraph engineer
    Policy changes go through a request, a test and your approval before Moraph applies them.

  4. Step 4

    Reported message triage

    A reported message is investigated, removed from every mailbox that received it, and escalated where someone clicked.

    EM-7734 · Message impersonating the CEO to finance staff

    Reported by
    Staff member, Accounts Payable
    Sender
    Lookalike of example-health.org (fictional)
    Recipients
    6
    Request in message
    Urgent wire to a new account
    Replies
    1 recipient replied
    Verdict
    Impersonation, confirmed

    Actions taken

    • Message removed from all 6 mailboxes
    • Sender domain blocked under the runbook
    • Reply escalated to your security owner and finance lead
    A reported message is investigated, removed from every mailbox that received it, and escalated where someone clicked.

  5. Step 5

    Monthly service review

    Each month Moraph reviews threats, triage and changes with your security owner and brings the decisions that are due.

    Monthly service review · sample month

    Messages reported by staff
    312
    Confirmed malicious
    41
    Removed after delivery
    58 messages
    Impersonation attempts on protected people
    9
    Incidents escalated as possible PHI
    1
    Changes applied
    3

    Decisions needed

    • Add the new chief nursing officer to the protected-people list
    • Approve moving one domain to DMARC quarantine
    • Agree a release rule for the bulk mail folder
    Each month Moraph reviews threats, triage and changes with your security owner and brings the decisions that are due.

  6. Step 6

    Console access review

    Access to the Proofpoint console and to message content is reviewed with you, and anything no longer needed is removed.

    PersonRoleContent accessLast usedDecision
    Admin User 01 (fictional)Messaging administratorNoThis weekKeep
    Analyst User 07 (fictional)Moraph analystHeaders onlyTodayKeep
    Admin User 04 (fictional)Security ownerYesLast monthKeep
    Contractor User 12 (fictional)Messaging administratorNoNot used in 90 daysRemove
    Access to the Proofpoint console and to message content is reviewed with you, and anything no longer needed is removed.

Workflows

The principal workflows

  1. Filter

    Inbound mail passes through Proofpoint before it reaches your mail system. Proofpoint filters spam and malware, checks links and attachments, and applies the policies Moraph configures for your organization.

    • Mail for your domains is routed through Proofpoint
    • Sender authentication results (SPF, DKIM, DMARC) are checked
    • Proofpoint classifies each message and checks links and attachments
    • Messages are delivered, tagged, quarantined or rejected according to policy
    • Quarantine digests let staff release legitimate mail where policy allows

  2. Protect executives

    Your executives, finance staff and other high-risk people are named in the policy, so messages that impersonate them, or that ask them to pay or change bank details, are flagged or held for review.

    • Your security owner approves the list of protected people and their known addresses
    • Rules flag display names that match a protected person from an outside address
    • Messages from lookalike domains of your organization and key vendors are held
    • External messages to finance staff asking for payment or banking changes carry a warning
    • The list is reviewed when people join, leave or change role

  3. Respond

    Messages your staff report, and messages Proofpoint flags after delivery, are triaged by Moraph analysts. Confirmed malicious messages are removed from every mailbox that received them, and anything touching patient data is escalated to you.

    • Staff report a suspicious message with the report button
    • A Moraph analyst reviews the message, its sender and who else received it
    • Confirmed malicious messages are removed from mailboxes and the sender blocked
    • Clicks, replies or credentials entered are identified and escalated to your team
    • The reporter is told the outcome and the incident record is closed with a reason

  4. Review and improve

    Each month Moraph reviews what was blocked, reported and escalated with your security owner, and brings the policy changes and decisions that are due.

    • Monthly service report prepared from Proofpoint and incident records
    • Most-targeted people and campaigns reviewed
    • Proposed tuning changes presented with their expected effect
    • Your security owner approves or declines each change
    • Approved changes applied and recorded

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Security owner

CISO, information security officer, IT security manager

Owns the email security program: which policies apply, who is protected, and what Moraph may do on its own.

Sees

  • All policies, protected-people lists and their versions
  • Incident volumes, outcomes and escalations
  • Most-targeted people and campaigns
  • Monthly service reports

Does

  • Approves policy changes and quarantine rules
  • Approves the list of protected executives and finance staff
  • Agrees the triage runbook, including what analysts may remove or block without asking
  • Reviews the monthly service report with Moraph
  • Decides who may see message content

Cannot

  • Apply policy changes directly; Moraph applies approved changes
  • Edit or delete incident history or the audit trail
Approvals
Approves every policy change, protected-people change and runbook change; changes they propose themselves need a second approver your organization names.
Notified about
Escalated incidents, campaigns aimed at protected people, and changes waiting for approval.

Privacy officer

HIPAA privacy officer, chief privacy officer, compliance officer

Decides whether an email incident involving patient information is a reportable breach and what notifications follow.

Sees

  • Incidents flagged as possibly involving PHI
  • Message details, recipients and actions taken for those incidents
  • Outbound encryption and PHI rule matches

Does

  • Reviews escalated incidents that may involve PHI
  • Requests further evidence from Moraph through the incident record
  • Records the breach risk assessment outcome
  • Records any notification decision and its date

Cannot

  • Change email policies or quarantine settings
  • Release quarantined messages
Approvals
Their breach determinations follow your organization's own approval process; the service records the outcome.
Notified about
Incidents escalated as possibly involving PHI and responses to their evidence requests.

Messaging administrator

Microsoft 365 administrator, Exchange or Google Workspace administrator, DNS administrator

Runs the mail system and DNS that Proofpoint sits in front of, and makes the routing and record changes the service needs.

Sees

  • Routing, connector and DNS change requests
  • Mail flow health and delivery issues
  • Quarantine releases for the mailboxes they support

Does

  • Makes approved routing and connector changes in your mail system
  • Publishes SPF, DKIM and DMARC records
  • Grants the permissions Proofpoint needs to remove delivered messages
  • Works delivery problems with Moraph

Cannot

  • Change Proofpoint policies
  • See the content of incident messages unless granted separately
Approvals
Routing and DNS changes follow your organization's change process; policy changes are approved by the security owner.
Notified about
Change requests assigned to them and mail flow alerts.

Moraph email security engineer

Moraph email security engineer, messaging security consultant

Configures and maintains the Proofpoint policies that put your decisions into effect.

Sees

  • Policy configuration and its version history
  • Message classification trends and false positives
  • Proofpoint release notes and service notices

Does

  • Builds and tunes filtering, impersonation, tagging and encryption rules
  • Tests proposed changes and reports their expected effect
  • Applies changes after your approval and records each version
  • Specifies routing and DNS changes for your administrators
  • Raises platform issues with Proofpoint support

Cannot

  • Apply a policy change without your approval
  • Make changes in your mail system or DNS
  • Decide whether an incident is a breach
Approvals
Every policy change they make is approved by your security owner first, except emergency sender blocks allowed by the runbook.
Notified about
Approved changes ready to apply, false-positive reports and Proofpoint service notices.

Moraph security analyst

Moraph security analyst, security operations analyst

Works the queue of reported and flagged messages and acts on confirmed threats within the runbook you approve.

Sees

  • Reported messages and messages Proofpoint flags after delivery
  • Sender, recipient and click information for each incident
  • Message content only where your organization grants it

Does

  • Triages reported messages and records the outcome
  • Removes confirmed malicious messages from mailboxes
  • Blocks senders and domains under the runbook
  • Escalates incidents with clicks, replies or possible PHI to your team
  • Releases quarantined messages on service desk requests within policy

Cannot

  • Change policies
  • Take actions outside the agreed runbook without your approval
  • Make breach or staff conduct decisions
Approvals
Actions outside the runbook, such as removing internal messages, need your security owner's approval.
Notified about
New reported messages, post-delivery detections and replies to their escalations.

Auditor (read-only)

Internal auditor, external auditor, compliance reviewer

Reviews email controls, incidents and evidence without being able to change anything.

Sees

  • Policy versions and approval records
  • Incident records and outcomes within the scope granted
  • Monthly service reports
  • The audit trail

Does

  • Searches and reads records within their scope
  • Exports reports they have been given access to, with each export logged
  • Leaves review notes where your organization enables them

Cannot

  • Change, approve or delete anything
  • Keep access after it expires
Approvals
Their access is approved by the security owner, with a scope and an end date.
Notified about
Nothing by default; access granted and expiring is confirmed to the person who approved it.

Permissions at a glance

ActionSecurity ownerPrivacyMail adminMoraph engineerMoraph analystAuditor
Propose a policy changeFullFullFullFullFullNo access
Approve a policy changeApprovesNo accessNo accessNo accessNo accessNo access
Apply policy changesNo accessNo accessNo accessFullNo accessNo access
Change the protected-people listApprovesNo accessNo accessFullNo accessNo access
Triage reported messagesView onlyNo accessNo accessNo accessFullNo access
Remove delivered messagesApprovesNo accessNo accessNo accessFullNo access
Release quarantined messagesFullNo accessOwn work onlyNo accessFullNo access
View incident message contentFullOwn work onlyNo accessNo accessOwn work onlyNo access
Record a breach determinationView onlyFullNo accessNo accessNo accessNo access
Change mail routing and DNSView onlyNo accessFullView onlyNo accessNo access
View reportsView onlyView onlyView onlyView onlyView onlyView only
View audit trailView onlyView onlyNo accessView onlyView onlyView only
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Nobody approves a change they proposed: policy and protected-people changes from Moraph are approved by your security owner, and changes the security owner proposes need a second approver you name.
  • The triage runbook sets exactly what Moraph analysts may do without asking, such as removing a confirmed malicious message or blocking an outside sender; anything else is escalated.
  • Access to message content is limited to the roles you choose. By default Moraph analysts work from message headers, links and attachments' verdicts, and see body content only where you grant it.
  • Every permission change is recorded with who made it and when, and access to the Proofpoint console is reviewed with you periodically. Auditors get temporary read-only access with a scope and an end date.

Features

What it does

Inbound filtering

Proofpoint filters spam, malware and phishing before mail reaches your mailboxes, using policies Moraph configures for your domains and departments.

Executive impersonation rules

Proofpoint flags messages that use a protected executive's name from an outside address, configured with the people your security owner names.

Lookalike domain rules

Messages from domains that imitate yours or your key vendors' are held or tagged, with the vendor list maintained with your finance team.

Link and attachment checks

Proofpoint Targeted Attack Protection rewrites links so they are checked when clicked, and tests attachments before delivery, where licensed.

External sender warnings

A banner on messages from outside your organization, with stronger wording for messages to finance staff that ask for payment or banking changes.

Removal after delivery

When a delivered message is found to be malicious, Proofpoint's automated removal pulls it from every mailbox that received it, including forwarded copies, where licensed.

Reported message triage

Moraph analysts review the messages your staff report, decide whether they are malicious, act under the agreed runbook and tell the reporter the outcome.

Sender authentication

Moraph plans your SPF, DKIM and DMARC records with your DNS team and moves DMARC toward enforcement in stages, so others cannot easily send as your domains.

Outbound encryption

Proofpoint Encryption is applied to outgoing messages that match your PHI rules or a staff keyword, where licensed.

Quarantine management

Quarantine folders and staff digests configured by message type, with rules on who may release what.

Most-targeted people

Proofpoint's reporting shows who in your organization receives the most targeted attacks, so protection and training can focus there.

Breach assessment evidence

For any incident that may involve PHI, a record of the message, recipients, clicks and actions taken, ready for your privacy officer's assessment.

Integrations

How it connects to your systems

Connects toHowWhat flows
Microsoft 365, Google Workspace or ExchangeMail for your domains is routed through Proofpoint and delivered to your mail system, which also grants the access needed to remove delivered messages.In and out: inbound and outbound mail flow. Out: removal actions on delivered messages.
DNSSPF, DKIM and DMARC records are planned by Moraph and published by your DNS administrators.Out: record specifications. In: DMARC aggregate reports for review.
DirectoryUsers, groups and departments from Microsoft Entra ID or Active Directory drive policies and the protected-people list.In: users, groups, titles and departments.
Report buttonStaff report suspicious messages from their mail client, and reports arrive in Moraph's triage queue.In: reported messages and the reporter.
SIEMProofpoint message and click events forwarded to your security information and event management system.Out: message, threat and click events.
Service deskQuarantine release requests and escalations flow between Moraph and your IT service management tool.In and out: tickets, status and resolution notes.
Single sign-onYour administrators and reviewers sign in to the Proofpoint console and Moraph's service portal through your identity provider (SAML).In: user identity and group membership for role assignment.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Your staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Changing policies, triaging messages and seeing message content are separate roles, granted only as you approve.

Business associate agreement

Because email can contain PHI, Moraph signs a business associate agreement with you; your agreement with Proofpoint covers its own handling.

Encryption and keys

Incident records held by Moraph are encrypted, and Moraph staff cannot reach them without your explicit, time-bound authorization.

Complete audit trail

Every policy change, removal, release and content view is logged with the person and time, and cannot be edited.

Data residency

Records Moraph keeps stay in the hosting region you choose: the United States, the United Kingdom or Australia. Proofpoint's data locations follow its own terms.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operational

Reported message queue

For moraph analysts and your security owner

Every reported message with its status, verdict, analyst and time open.

Break down by
Status, Verdict, Reporter department, Age
Delivered as
Live view in Moraph's service portal; CSV export
Used for
Making sure every report is triaged and the reporter told the outcome.

Removals and blocks

For security owner and messaging administrators

Messages removed from mailboxes and senders or domains blocked, with the reason and who acted.

Break down by
Action, Analyst, Threat type, Period
Delivered as
Live view; CSV export
Used for
Checking that actions stayed within the runbook and finding mailboxes affected by a campaign.

Quarantine releases

For security owner and service desk lead

Messages released from quarantine, by whom, and whether any were later found to be malicious.

Break down by
Quarantine folder, Released by, Department, Period
Delivered as
Live view; CSV export
Used for
Tuning quarantine rules and release rights.

Threats

Impersonation attempts

For security owner, CFO and finance leadership

Messages that impersonated a protected person or came from a lookalike domain, and what happened to them.

Break down by
Protected person, Lookalike domain, Outcome, Period
Delivered as
Live view; PDF for leadership; CSV export
Used for
Showing executives the attacks aimed at them and keeping the protected list current.

Most-targeted people

For security owner and awareness training lead

The people receiving the most targeted messages, from Proofpoint's reporting, and the threat types involved.

Break down by
Person, Department, Threat type, Period
Delivered as
Monthly service report; CSV export
Used for
Focusing extra protection and training where attacks concentrate.

Clicks and exposures

For security owner and incident response team

Clicks on links later found to be malicious, replies to impostor messages and credentials possibly entered, with follow-up status.

Break down by
Department, Incident, Follow-up status, Period
Delivered as
Live view; scheduled email
Used for
Making sure every exposure is followed up, such as a password reset.

Management

Monthly service report

For security owner and IT leadership

Mail volumes, messages blocked, reports triaged, escalations, changes applied and decisions due in the month.

Break down by
Period, Threat type, Outcome
Delivered as
PDF; reviewed in the monthly service meeting
Used for
Overseeing the service and making the decisions Moraph brings.

Sender authentication status

For security owner and messaging administrators

SPF, DKIM and DMARC status for each of your domains, the DMARC policy in force and sources sending as your domains.

Break down by
Domain, Policy, Sending source, Result
Delivered as
Monthly service report; CSV export
Used for
Planning the move to DMARC enforcement without blocking legitimate senders.

Compliance and audit

Incidents involving possible PHI

For privacy officer

Incidents escalated as possibly involving patient information, with the evidence provided and the breach determination recorded.

Break down by
Incident, Determination, Date escalated, Date decided
Delivered as
Live view; PDF export
Used for
Supporting breach risk assessments and keeping the record of each decision.

Policy change history

For security owner and auditors

Every policy and protected-people change, who proposed and approved it, and when it took effect.

Break down by
Policy, Change date, Approver, Change type
Delivered as
Live view; PDF and CSV export
Used for
Evidencing that email controls are governed and changes approved.

Audit trail extract

For internal audit and compliance

Who did what and when for a selected incident, policy or period, including content views and releases.

Break down by
Record, User, Action, Date range
Delivered as
On request; CSV and PDF export
Used for
Answering auditor and HIPAA risk analysis requests for evidence.

Exports, access and evidence

  • Reports Moraph produces are available in its service portal and can be exported to CSV, with summary reports in PDF. The monthly service report is delivered before each service meeting.
  • Proofpoint's own console reports remain available to your administrators under the roles you grant; Moraph's reports combine them with triage and change records.
  • Message and click events can be forwarded to your SIEM so email incidents appear alongside your other security data.
  • Reports respect each viewer's role: the privacy officer sees incidents escalated to them, and message content appears only for roles you have granted it.
  • Running and exporting a report is recorded in the audit trail, and compliance reports can be run for a past period.

Deployment

Where and how it runs

Proofpoint cloud service

Proofpoint operates the email security service in its cloud; Moraph configures and runs it for you.

Existing deployment

Where you already own Proofpoint, Moraph takes over its operation and tuning without a fresh setup.

With other Moraph services

Run alongside Moraph's Secure Messaging, Cloud Content or Identity Governance services.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Scoping

We agree the domains, mailboxes, modules and protected people in scope, and review any existing Proofpoint deployment. We need contacts from security, messaging, finance and privacy.

Routing and connection

Moraph specifies the mail routing, connectors and directory connection, and your administrators make the changes in your mail system and DNS.

Policy baseline

Filtering, impersonation, tagging, quarantine and encryption policies are configured from a documented baseline and reviewed with your security owner.

Monitoring period

Policies run with tagging and quarantine before stricter actions apply, so false positives can be found and legitimate senders allowed.

Sender authentication

SPF, DKIM and DMARC are reviewed for each domain and a staged plan agreed for moving DMARC toward enforcement.

Runbook and handover

The triage runbook, escalation routes and service desk process are agreed, the report button is deployed, and Moraph's analysts take over the queue.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not Proofpoint. Proofpoint's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
  • Licences bought through Moraph remain subject to Proofpoint's licence terms, and some features described here depend on the modules you license.
  • No email filter stops every phishing or impersonation message. Staff awareness and a verification procedure for payment and banking changes are still needed, and those procedures belong to your organization.
  • Removal after delivery depends on the permissions your mail system grants and on messages still being in mailboxes Proofpoint can reach.
  • Moraph does not run your mail system or DNS; changes there are made by your administrators.
  • Breach determination and any notification to patients, HHS or the media remain your organization's decisions.
  • Security awareness training and simulated phishing are not included unless added to the scope.
  • Moraph supports your HIPAA risk analysis and audits with evidence; it does not certify your compliance.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. List the executives and finance staff you would protect and ask how impersonation of each would be handled
  2. Review the triage runbook and decide what Moraph may do without asking
  3. Walk through a reported message from report to removal and escalation
  4. Check which modules your current or proposed Proofpoint licence includes
  5. Review your SPF, DKIM and DMARC status for each domain with Moraph
  6. Confirm who on your side approves policy changes and who makes breach determinations

Questions

Frequently asked questions

We already own Proofpoint. Can you run it?

Yes. Moraph can take over an existing deployment, review its policies, and tune and operate it rather than starting again.

Will Moraph read our staff's email?

Only within the access you grant. By default analysts work from headers, links and attachment verdicts, and message content is limited to the roles you name. Every content view is logged.

Can you stop a fake wire request to our CFO?

Proofpoint, configured with your protected people and lookalike rules, flags or holds many such messages. None of this replaces a verification procedure for payment and banking changes, which your finance team owns.

Who decides whether an email incident is a HIPAA breach?

Your privacy officer. Moraph provides the message record, recipients, clicks and actions taken; the determination and any notifications are your organization's.

Do we need a business associate agreement?

Yes. Moraph signs one with you because email can contain PHI, and your agreement with Proofpoint covers Proofpoint's own handling.

How is it priced?

Proofpoint licences are priced under Proofpoint's terms, usually by mailbox and module, and the managed service by the scope operated. See Working with Moraph for what drives a quotation.

Next steps

Evaluate Email Security

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Email Security guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Email Security support guide.

Related products