Security1 publisher2 min readPublished
Proofpoint absorbs Acuvity to see which AI services staff and machines are calling
The deal gives Proofpoint telemetry on what employees and automated systems do with external AI services, and it is the second AI security startup bought by an established vendor in about a week. Terms were not disclosed.
The Watch · Security desk
What happened
- Proofpoint said on Thursday that it had acquired Acuvity, an AI security startup, with Acuvity's engineering team slated to join the California company.
- Acuvity's platform monitors AI usage in web browsers, in Model Context Protocol servers and in locally installed AI tools, and tracks how employees and automated systems call external AI services.
- Data security firm Varonis acquired AI security firm AllTrue.ai for $150 million the week before, the only price disclosed for either transaction.
- Proofpoint's previous acquisition was Hornetsecurity Group last May, a Microsoft 365 security provider bought in a deal reportedly valued at more than $1 billion.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Security teams scoping a standalone tool for AI usage visibility now have to weigh buying the same function as a module from a vendor already on the mail security invoice.
- exposure Coverage of locally installed models and MCP servers depends on collection landing at those endpoints, and no deployment date is on the record, so the gap persists in the meantime.
- constraint With Acuvity's price withheld, a buyer negotiating an AI visibility line item has exactly one public comparable to argue from.
- precedent Two of these startups absorbed inside about a week makes it likely the next agentic-AI control arrives as a module in a suite a customer already owns.
Prompt injection and model manipulation are the attack techniques CyberScoop names in its report on the deal, and it says traditional security products were not designed to address them [8]. Acuvity's stated function is visibility and governance for AI applications, tracking of how employees and automated systems interact with external AI services, and protection for models an organisation built in house [5].
Ryan Kalember, Proofpoint's chief strategy officer, described the buyer-side demand in those terms. "It has definitely been a pivot from, 'I got to be able to stop prompt injection' to 'I have to be able to figure out what the AI is even doing,'" he told CyberScoop [9]. He said CISOs want to keep governance without impeding innovation, and that the pace of AI adoption has outstripped many companies' ability to secure these systems [15].
One number in this segment is public and one is reported. AllTrue.ai's disclosed $150 million is at most about 15 percent of the more than $1 billion Proofpoint was reported to have paid for Hornetsecurity in May [11]. The Hornetsecurity figure is reported, not disclosed [6].
Kalember said he sees Acuvity helping small and medium organisations that use Hornetsecurity's Microsoft 365 services [7]. "That is going to be a world in which, independent of the size of the organization, they are going to very much leverage AI, and some of that will be built into the tools like M365 that is tightly coupled with the Hornetsecurity architecture," Kalember said [12].
Proofpoint's announcement leaves out the integration date, the Acuvity customer count and the transaction value [16]. That matters because the agentic systems in question are already in software development, customer support, finance and legal operations, reaching sensitive data and running tasks that people used to run [14]. A monitoring product that exists on an acquirer's roadmap does not log an MCP server that a developer stood up last month. The record says Acuvity's engineering team is joining Proofpoint, and Kalember called the deal more than a pure "technology acquisition" [3]; a date for the telemetry reaching a customer console is not in it.
What to watch
- A Proofpoint SKU or product page naming Acuvity's MCP and local-model monitoring, with a ship date attached.
- Whether the capability reaches Hornetsecurity's small and medium business base or stays in enterprise tiers.
- A disclosed price on the next AI-security acquisition; the segment currently has one public comparable.