/people

name: "Proofpoint People"
description: >
  Proofpoint People-Centric Security fundamentals: Very Attacked People (VAP)
  reports, attack index scoring, click susceptibility, top clickers, and user risk
  categorization for targeting security controls and training.
when_to_use: >-
  When identifying high-risk or heavily targeted users, analyzing click behavior, or working with
  VAP/attack-index data in Proofpoint. Use when: proofpoint people, very attacked people, vap
  report, proofpoint vap, top clickers, user risk, attack index, proofpoint user risk, high risk
  users, most attacked users, user threat profile, people-centric security, or proofpoint risk
  score.

Proofpoint People-Centric Security

Overview

Proofpoint People-Centric Security provides user-level threat analytics that identify which individuals in your organization are most targeted by attacks and most susceptible to clicking on threats. This data enables MSPs to implement targeted security controls, prioritize security awareness training, and apply adaptive authentication policies for the highest-risk users.

The core concept is that people - not infrastructure - are the primary target of modern email attacks. By understanding who is targeted and who clicks, you can focus security resources where they have the most impact.

Anti-triggers

• **Simulated-phishing risk scores** — KnowBe4 also reports a per-user

"risk score" and a click rate, but those measure tests the MSP sent deliberately. Attack Index and VAP count real attacks. For simulation performance use `knowbe4-users`.

• **Enrolling a high-risk user in awareness training** — this skill

identifies who needs it; the enrollment itself is `knowbe4-training`.

• **The individual threat events behind a user's Attack Index** — use

`proofpoint-tap`, and `proofpoint-threat-intel` for the campaigns named in `topCampaigns`.

Key Concepts

Very Attacked People (VAP)

VAPs are users who receive a disproportionately high volume of sophisticated attacks. VAP status is determined by:

• **Attack volume** - Total number of threats targeting the user
• **Attack sophistication** - Complexity and novelty of attacks
• **Attack diversity** - Variety of threat actors and campaigns targeting the user

VAPs are typically executives, finance personnel, IT administrators, and people with external-facing email addresses.

Attack Index

The Attack Index is a composite score (0-1000+) that quantifies the severity of threats targeting a user. It factors in:

| Component | Weight | Description | |-----------|--------|-------------| | Volume | Medium | Number of threats received | | Sophistication | High | How advanced the attacks are | | Actor reputation | High | Whether known threat actors are involved | | Threat type mix | Medium | Diversity of attack types (phish, malware, BEC) |

Higher Attack Index = more severe threats targeting the user.

Click Susceptibility

| Metric | Description | Range | |--------|-------------|-------| | `clickRate` | Percentage of threats the user clicked on | 0-100% | | `clickCount` | Total number of malicious clicks | Integer | | `uniqueThreatsClicked` | Distinct threats clicked | Integer | | `lastClickTime` | Most recent click on a threat | Datetime |

User Risk Categories

| Category | Attack Index | Click Rate | Action | |----------|-------------|------------|--------| | **Very High Risk** | > 500 | > 10% | Isolate browsing, MFA everywhere, priority training | | **High Risk** | 200-500 | 5-10% | Enhanced email filtering, additional MFA | | **Medium Risk** | 50-200 | 2-5% | Standard controls, regular training | | **Low Risk** | < 50 | < 2% | Baseline controls |

Field Reference

VAP Report Fields

| Field | Type | Description | |-------|------|-------------| | `identity` | object | User identity details | | `identity.emails` | string[] | User email addresses | | `identity.name` | string | User display name | | `identity.department` | string | User department | | `identity.title` | string | User job title | | `identity.vip` | boolean | Whether the user is flagged as VIP | | `attackIndex` | int | Composite attack severity score | | `threatStatistics` | object | Breakdown of threats by type | | `threatStatistics.totalThreats` | int | Total threats received | | `threatStatistics.malwareCount` | int | Malware threats received | | `threatStatistics.phishCount` | int | Phishing threats received | | `threatStatistics.impostorCount` | int | BEC/impostor threats received | | `families` | string[] | Threat families targeting this user | | `topCampaigns` | object[] | Most significant campaigns targeting this user |

Top Clickers Fields

| Field | Type | Description | |-------|------|-------------| | `identity` | object | User identity details | | `clickStatistics` | object | Click activity breakdown | | `clickStatistics.clickCount` | int | Total malicious clicks | | `clickStatistics.permitCount` | int | Clicks that were permitted | | `clickStatistics.blockCount` | int | Clicks that were blocked | | `clickStatistics.clickRate` | float | Click-through rate on threats | | `clickStatistics.uniqueThreats` | int | Distinct threats clicked | | `clickStatistics.lastClick` | datetime | Most recent click time | | `clickStatistics.classifications` | object | Breakdown by malware, phish |

User Risk Profile Fields

| Field | Type | Description | |-------|------|-------------| | `email` | string | User email address | | `riskScore` | int | Overall risk score (0-1000) | | `attackIndex` | int | Attack severity targeting this user | | `clickRate` | float | Historical click-through rate | | `riskCategory` | string | `very_high`, `high`, `medium`, `low` | | `vulnerabilityFactors` | string[] | Contributing risk factors | | `recommendedActions` | string[] | Suggested remediation steps | | `trainingStatus` | object | Security awareness training completion |

MCP Tools

| Tool | Description | Key Parameters | |------|----------