Email Security

Principal workflows

• Filter: Inbound mail passes through Proofpoint before it reaches your mail system. Proofpoint filters spam and malware, checks links and attachments, and applies the policies Moraph configures for your organization.
• Protect executives: Your executives, finance staff and other high-risk people are named in the policy, so messages that impersonate them, or that ask them to pay or change bank details, are flagged or held for review.
• Respond: Messages your staff report, and messages Proofpoint flags after delivery, are triaged by Moraph analysts. Confirmed malicious messages are removed from every mailbox that received them, and anything touching patient data is escalated to you.
• Review and improve: Each month Moraph reviews what was blocked, reported and escalated with your security owner, and brings the policy changes and decisions that are due.

Who uses it

• CISOs and information security teams at hospitals and health systems
• CFOs, finance and accounts payable teams who handle payment and banking requests
• HIPAA privacy officers who assess possible breaches
• Messaging and Microsoft 365 or Google Workspace administrators
• Internal audit and compliance teams who need evidence of email controls

Reporting

• Reported messages triaged, by verdict and time open
• Messages removed after delivery and senders blocked
• Impersonation attempts against protected people
• Most-targeted people and threat types
• Incidents escalated as possibly involving PHI
• Policy change history for auditors

Features

• Inbound filtering: Proofpoint filters spam, malware and phishing before mail reaches your mailboxes, using policies Moraph configures for your domains and departments.
• Executive impersonation rules: Proofpoint flags messages that use a protected executive's name from an outside address, configured with the people your security owner names.
• Lookalike domain rules: Messages from domains that imitate yours or your key vendors' are held or tagged, with the vendor list maintained with your finance team.
• Link and attachment checks: Proofpoint Targeted Attack Protection rewrites links so they are checked when clicked, and tests attachments before delivery, where licensed.
• External sender warnings: A banner on messages from outside your organization, with stronger wording for messages to finance staff that ask for payment or banking changes.
• Removal after delivery: When a delivered message is found to be malicious, Proofpoint's automated removal pulls it from every mailbox that received it, including forwarded copies, where licensed.
• Reported message triage: Moraph analysts review the messages your staff report, decide whether they are malicious, act under the agreed runbook and tell the reporter the outcome.
• Sender authentication: Moraph plans your SPF, DKIM and DMARC records with your DNS team and moves DMARC toward enforcement in stages, so others cannot easily send as your domains.
• Outbound encryption: Proofpoint Encryption is applied to outgoing messages that match your PHI rules or a staff keyword, where licensed.
• Quarantine management: Quarantine folders and staff digests configured by message type, with rules on who may release what.
• Most-targeted people: Proofpoint's reporting shows who in your organization receives the most targeted attacks, so protection and training can focus there.
• Breach assessment evidence: For any incident that may involve PHI, a record of the message, recipients, clicks and actions taken, ready for your privacy officer's assessment.

Integrations

• Microsoft 365, Google Workspace or Exchange: Mail for your domains is routed through Proofpoint and delivered to your mail system, which also grants the access needed to remove delivered messages.
• DNS: SPF, DKIM and DMARC records are planned by Moraph and published by your DNS administrators.
• Directory: Users, groups and departments from Microsoft Entra ID or Active Directory drive policies and the protected-people list.
• Report button: Staff report suspicious messages from their mail client, and reports arrive in Moraph's triage queue.
• SIEM: Proofpoint message and click events forwarded to your security information and event management system.
• Service desk: Quarantine release requests and escalations flow between Moraph and your IT service management tool.
• Single sign-on: Your administrators and reviewers sign in to the Proofpoint console and Moraph's service portal through your identity provider (SAML).

Deployment

• Proofpoint cloud service: Proofpoint operates the email security service in its cloud; Moraph configures and runs it for you.
• Existing deployment: Where you already own Proofpoint, Moraph takes over its operation and tuning without a fresh setup.
• With other Moraph services: Run alongside Moraph's Secure Messaging, Cloud Content or Identity Governance services.

Security and privacy

• Single sign-on: Your staff sign in through your identity provider, so your password and multi-factor policies apply.
• Role-based access: Changing policies, triaging messages and seeing message content are separate roles, granted only as you approve.
• Business associate agreement: Because email can contain PHI, Moraph signs a business associate agreement with you; your agreement with Proofpoint covers its own handling.
• Encryption and keys: Incident records held by Moraph are encrypted, and Moraph staff cannot reach them without your explicit, time-bound authorization.
• Complete audit trail: Every policy change, removal, release and content view is logged with the person and time, and cannot be edited.
• Data residency: Records Moraph keeps stay in the hosting region you choose: the United States, the United Kingdom or Australia. Proofpoint's data locations follow its own terms.

Limitations

• Moraph is not Proofpoint. Proofpoint's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to Proofpoint's licence terms, and some features described here depend on the modules you license.
• No email filter stops every phishing or impersonation message. Staff awareness and a verification procedure for payment and banking changes are still needed, and those procedures belong to your organization.
• Removal after delivery depends on the permissions your mail system grants and on messages still being in mailboxes Proofpoint can reach.
• Moraph does not run your mail system or DNS; changes there are made by your administrators.
• Breach determination and any notification to patients, HHS or the media remain your organization's decisions.
• Security awareness training and simulated phishing are not included unless added to the scope.
• Moraph supports your HIPAA risk analysis and audits with evidence; it does not certify your compliance.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/email-security. Purchasing routes and company information: www.moraph.com/how-to-buy.