Email and Employee Protection
Phishing, impersonation of management and vendors, accounts compromised despite MFA, and simple sending errors. We protect email and collaboration tools both ways – from what comes in and what goes out – and help people become an effective line of defense, not the weakest link. Powered by Proofpoint technology.
60%
of attacker intrusions started with phishing – according to ENISA Threat Landscape 2025, which covered 4,875 incidents in the EU from July 2024 – June 2025.1
Conclusion: a simple anti-spam filter is not enough. Today’s attacks involve a link instead of an attachment, an account compromised despite MFA, and a message from a “vendor” that is indistinguishable from a legitimate one.
Scenarios from Proofpoint, ENISA, and FBI reports. In none of them does the attacker need to break technical security – it’s enough for someone to click, pay, or send.
Malicious messages more often carry a link than an attachment, ClickFix campaigns increased by almost 400% year-over-year, and in the first half of 2025, Proofpoint detected 4.2 million threats with QR codes.2
Proofpoint Prime Threat Protection: checks links in real-time and blocks them at the moment of clicking – including in messengers, collaboration tools, and social media.5
A message from a “vendor” requesting a change of account or from the “CEO” with an urgent transfer. In 2025, the FBI recorded 24,768 reports of BEC scams.4
Proofpoint Email Fraud Defense: DMARC implementation with expert assistance, detection of domains similar to yours, and vendor risk assessment – based on monitoring over 650 million domains.6
An attacker intercepts a session via an intermediary site, sets up an email forwarding rule, and adds their own MFA method. 59% of compromised accounts had MFA enabled.3
Proofpoint Account Takeover Protection: detects account takeovers in Microsoft 365, Google Workspace, and Okta – even after MFA bypass – tracks attacker actions, and automatically revokes mailbox rules, malicious applications, and MFA changes.3
Attacks are not evenly distributed. Accounting, management, assistants, HR – some individuals receive disproportionately more attacks, while protection and training are the same for everyone.
Proofpoint Human Risk Explorer: combines signals from email protection, identity, data, and training into a risk assessment for individuals and departments, and suggests which security measures to apply.7
The same presentation for everyone once a year doesn’t change behavior. People learn from situations that directly affect them.
Proofpoint ZenGuide: training paths and phishing simulations tailored to risk level, behavior, and attack exposure – based on real threat data.8
Autocompleted address, wrong attachment, file to a private inbox. 58% of organizations attribute major data loss incidents to careless employees.9
Proofpoint Adaptive Email DLP: learns sender habits based on over 12 months of correspondence and warns or blocks messages to unusual recipients, with incorrect attachments, or to private accounts.10
Every company today has an anti-spam filter and attachment scanning. Today’s attacks are designed precisely to bypass them.
The most dangerous message doesn’t have a malicious attachment. It comes from a legitimate inbox of a compromised vendor.
Proofpoint
Proofpoint calls its approach human-centric: protection starts with asking who is being attacked, how, and with what effect. That’s why email protection, account protection, data protection, and education exchange signals within a single platform.7
Against phishing, BEC, and malware – via API in Microsoft 365 or as an email gateway.5
Real-time link checking, also outside of email: in messengers, collaboration tools, and social media.
DMARC, detection of similar domains, and removal of fake websites impersonating your brand.6
Detection of cloud account takeovers and automatic reversal of changes made by the attacker.
Adaptive Email DLP and policy-based encryption protect against errors and data leaks.
ZenGuide and Human Risk Explorer: risk-based training and a map of the most vulnerable individuals.
According to the vendor, 85 Fortune 100 companies use Proofpoint.5
Identity and Secure Access
Secure and Responsible AI
Effective education starts with data: who is being attacked, how they react, and what access they have. ZenGuide calculates a user’s risk score from three components – attack exposure, vulnerability, and privileges – and tailors training and interventions based on this.8
The vendor describes this as a cycle: detect, respond, change behavior, evaluate effect.
Article 21(2) lists basic cyber hygiene practices and cybersecurity training (point (g)) as well as secured voice, video, and text communication (point (j)).11
A message containing personal data sent to the wrong recipient can be a data breach. The controller must report it to the authority within 72 hours, unless the risk is unlikely (Article 33).12
The amendment to Poland’s National Cybersecurity System Act (KSC Act) implementing NIS2 comes into force on April 3, 2026. Essential and important entities have until April 3, 2027, to implement their obligations, and managers are also responsible for cybersecurity.13
Regulations do not specify products. We help translate them into concrete email security measures and an auditable education program.
SafeWave has been operating since 1998 as a vendor-agnostic integrator. We implement solutions in stages to ensure protection does not interrupt company correspondence.
We check email and domain configurations (SPF, DKIM, DMARC), what passes through current filters, and whether account takeovers are occurring in your environment.
Email and link protection, account takeover detection, outbound message DLP – initially in monitoring mode.
We guide your domain from monitoring to rejecting impersonating messages – without blocking legitimate correspondence.
Risk-based training and simulations, plus a report on the most vulnerable individuals. Support in English and Polish.
Let’s start with an email and domain review. We’ll show you if your company can be impersonated and what threats are bypassing your current security measures.