Companies Using Proofpoint

An MX record is not a licence

Most counts on this site read something a website chose to put on a page. This one reads DNS. Proofpoint is identified from a domain's MX records pointing at Proofpoint's mail hosts, which means the thing we are measuring is live mail routing rather than a purchase. If accenture.com publishes those records, Accenture's inbound mail is passing through Proofpoint while you read this. I would rather have that than a page tag any day, and the reason is what happens when a customer leaves: they change their MX the same afternoon, and the signal goes with them. Nothing lingers.

You can see that in the churn. 1,332 domains have stopped routing mail through Proofpoint since mid-March, 2.5% of the 53,149 live. A page-based signal on a base this size churns at several times that rate, and much of what it reports is measurement rather than departure, because a script can fail to load or a page can time out and the domain reads as gone. A DNS record either resolves or it does not. If you want the mechanics of how these signals differ we wrote up the detection methods behind them.

A page tag tells you somebody bought something once. An MX record tells you their mail is going through it right now, and it stops telling you the day they leave.

The limit is worth stating with the same directness. This measures one gateway, the enterprise one at pphosted.com, and nothing else. Proofpoint Essentials, the gateway sold to smaller organisations, answers on separate mail hosts and is not inside this figure. Proofpoint also sells archiving, training and several other things that leave no trace in DNS, so an organisation running those without pointing its mail at pphosted.com is invisible to us. Read 53,149 as an accurate census of the enterprise gateway and a floor for the company.

A quarter of this base is finance or healthcare

Financial Services is 11.64% of the 37,391 companies with a recorded industry, 2.4 times Hospitals and Health Care at 4.79%, and nothing else reaches 5%. Most industry charts we publish are flatter than that, with the leader and the runner-up separated by a point or two. Add Insurance (3.94%) and Medical Practices (3.32%) and the regulated block is 8,861 companies, 23.7% of the base. Counting Banking as well makes it 9,572 and 25.6%, so a quarter of everything here is finance, insurance or healthcare.

The age chart says the same thing in a different language. Pre-1960 is the largest founding band at 20.12%, ahead of the 2010s, and 42.25% of this base was founded before 1990. Pfizer dates to 1848, HSBC to 1865, Scotiabank to 1832, the United States Postal Service to 1776. That ordering shows up on fewer than one profile in twenty that we publish. What it describes is an organisation that has had a compliance obligation for longer than email has existed, and treats the mail gateway as part of the control environment rather than as a tool it might swap next year.

Contrast that with the size chart, which looks small at first glance. 1-10 is the biggest band at 31.01%, but 47.19% of the base employs between 11 and 500 and 31.91% employs more than 200. Mimecast, which we detect the same way, has 25.53% in the smallest band. Neither of these is a small-business product. Both charts are being read from the same DNS fact, which is what makes the comparison worth anything.

New Zealand outranks Italy, and Britain is smaller than it looks

The United States is 55.26% of the located base, which is unremarkable. The rest is not. New Zealand ranks seventh on 1,207 companies, ahead of Spain and Italy, and Australia plus New Zealand together hold 3,101 against the United Kingdom's 2,169. New Zealand outranking both Italy and Spain on a US security product is the sort of row I check twice before publishing.

I am not going to invent a cause for it. What I will say is that the same category contains the opposite pattern: on Mimecast, Britain is roughly a quarter of the located base, against 5.16% here. Two gateways, one detection method, one category, and outside America their maps barely overlap. I have no evidence for why, and I am not going to guess in public.

Why this page has no migration table

Because we have not measured one. The pairwise switching work has not been run for Proofpoint, and I would rather ship a page with a gap in it than infer a corridor from churn counts, which is the most common way these numbers go wrong. A drop and a gain in the same month are not a switch until you have checked that the same domains are on both sides of it.

What the turnover figures do support is a statement about stability. 716 domains dropped in the last 30 days and 1,332 since mid-March, and 1,306 of those 1,332 fall inside the last 90 days, which reflects when the signal came under observation more than anything in the market. At 2.5% of the live base this sits in the quietest tenth of the profiles we publish, and the mechanism rather than customer loyalty is what puts it there.

Low churn on a DNS signal is not loyalty. It is that DNS does not lie about whether something is still there.

The stack on this page measures a different system

Every overlap percentage below the fold is read from a web page, and Proofpoint is read from DNS, so this table is not Proofpoint's stack. It is a portrait of the websites belonging to organisations whose mail Proofpoint filters, and nothing in it touches the mail path. Once you read it that way it is genuinely informative, mostly about how old these sites are: jQuery on 73.01%, jQuery Migrate on 32.52%, and jQuery Migrate exists only to stop code written for an older jQuery from breaking.

The row I keep coming back to is WordPress at 30.6%, against 46.07% on Mimecast domains. WordPress share is a decent proxy for how much of a base is small firms on a template, and a fifteen-point gap between two products in the same category is the size chart showing up again in a different table. Cloudflare at 43.71% and Google Tag Manager at 71.46% are what you would expect from anyone with a marketing team.

What to take from this

Proofpoint holds 7.39% of our Email Security category on 53,149 domains, and the honest way to place that is beside the other gateways organisations put in front of their mail: Mimecast 69,123, MailChannels 65,764, Barracuda 64,320, Proofpoint 53,149, Sophos 46,240, Hornetsecurity 41,397. Six products inside 27,726 domains, which is a band rather than a hierarchy, and Mimecast is the only one of them I would set beside Proofpoint number for number, because it is the one we read from the same kind of record.

If you sell into this base, the segment to isolate is the regulated quarter: 8,861 companies in finance, healthcare and insurance, skewing old, skewing mid-market, and moving slowly in both directions. The number to argue with is 53,149, and the honest thing to say about it is that it is exactly right for the enterprise gateway and too low for the company. TechnologyChecker.io resolves it against 42,005 identified organisations and refreshes it every month.