Hornetsecurity Q4 2026 Updates Add Microsoft 365 Permission Risk Dashboard and AI Admin Tools

To help administrators and Managed Service Providers (MSPs) clean up that foundation before AI tools amplify existing mistakes, Hornetsecurity by Proofpoint announced a set of Q4 2026 feature updates across its Microsoft 365 security portfolio. First previewed in early October 2026 ahead of the it-sa cybersecurity trade fair in Nuremberg and detailed in a broader October 15 announcement via PR Newswire, the updates focus on four practical operational areas: tenant permission visibility, explainable email threat assessments, automated security awareness coaching inside Microsoft Teams, and a conversational assistant for the administrator Control Panel.

Here is a look at what the new capabilities actually do, how they fit into day-to-day Microsoft 365 administration, and the critical architectural questions IT teams should ask before deploying them.

How Hornetsecurity Fits into the Proofpoint Ecosystem​

If the "Hornetsecurity by Proofpoint" branding still looks relatively fresh on your vendor sheets, there is recent corporate history behind it. Proofpoint completed its acquisition of the Hanover, Germany-based Hornetsecurity Group in December 2025 to expand its footprint in the SMB and MSP channel. By May 2026, Proofpoint formally established its dedicated MSP Platform business unit to bring the flagship 365 Total Protection suite to a wider global audience, including North America.

Rather than targeting sprawling Fortune 500 security operations centers that already have dedicated identity governance teams, Hornetsecurity's portfolio is built specifically for MSPs and resource-constrained IT departments managing Microsoft 365 tenants. The October 2026 updates follow earlier January 2026 releases that introduced the AI Email Security Analyst and Teams Protection for malicious message and impersonation detection.

Section Summary: Operating as Proofpoint's MSP- and SMB-focused business unit since late 2025, Hornetsecurity is rolling out four Q4 2026 enhancements designed to tighten Microsoft 365 data hygiene, message triage, user training, and multi-tenant management.

Hunting Down Permission Sprawl with Tenant Risk Exposure​

Ask any veteran systems administrator what happens to a Microsoft 365 tenant after five years of organic growth, and you will likely hear a heavy sigh. Every new project channel in Microsoft Teams spins up corresponding SharePoint resources. External vendors are invited in as guests for a three-week sprint and remain active for three years. Employees generate "Anyone with the link" URLs in OneDrive to bypass attachment limits and never revoke them.

As Hornetsecurity CEO Daniel Hofmann noted in the October 15 announcement, overly broad permissions and unclear sharing settings do not originate with AI, but deploying AI tools across those structures magnifies their impact.

To address this, Hornetsecurity is adding a Tenant Risk Exposure dashboard to its existing 365 Permission Manager service, which governs access across SharePoint, OneDrive, and Microsoft Teams. Designed for MSPs and internal admins who lack the time to crawl through nested SharePoint access control lists manually, the updated interface introduces dashboard widgets that flag six specific exposure categories:

• Anonymous access (such as unauthenticated sharing links)
• External users with active access to internal resources
• Organization-wide permissions that expose files to every licensed user in the tenant
• Public groups whose contents can be browsed by anyone inside the directory
• Inactive guests who have not signed in or collaborated recently
• Orphaned accounts that remain provisioned or retain permissions without an active owner

According to the company, the interface generates an at-a-glance tenant status report and provides direct shortcuts to remediate flagged risks either manually or automatically.

What Admins Should Verify​

While a single visual dashboard for SharePoint, OneDrive, and Teams permissions is genuinely helpful—especially given how fragmented native Microsoft Purview and SharePoint Admin Center reports can feel without Microsoft Entra ID Governance or Copilot-tier licensing—the vendor announcement leaves several technical details open.

Hornetsecurity has not specified the exact threshold criteria used to define an "inactive guest" or "orphaned account," nor has it detailed which specific remediation actions can run on full autopilot without breaking active business workflows. Administrators should treat Tenant Risk Exposure as a visibility and workflow accelerator rather than a hands-off replacement for formal access reviews.

Section Summary: Tenant Risk Exposure adds six risk-tracking widgets to 365 Permission Manager across SharePoint, OneDrive, and Teams, giving admins visual reporting and manual or automated remediation shortcuts for common oversharing traps.

Taking the Black Box Out of Email Filtering​

The second pillar of the Q4 2026 update targets a perennial headache for security analysts and helpdesk technicians: the opaque "AI said so" email verdict.

Modern email security gateways rely heavily on machine learning models to catch business email compromise (BEC), credential phishing, and socially engineered payloads that lack traditional malware signatures. When an executive's legitimate contract gets quarantined—or a borderline phishing email slips into an inbox—admins need to know why the filter made that call before they adjust tenant policies or release the message.

Hornetsecurity's new Explainability in Email Live Tracking feature is built to surface the reasoning behind email security assessments. When inspecting message logs, security teams are shown why a particular message was classified as either suspicious or legitimate. The stated goal is to speed up the investigation of rare false positives or questionable verdicts so administrators can apply targeted remediation without guessing at which heuristic triggered the block.

From an operational standpoint, this should be viewed as an administrative triage improvement rather than a change to underlying threat detection rates. The announcement does not disclose the exact visual format of these explanations, which underlying signals are exposed to the admin, or whether explainability data is generated for every scanned message in the queue.

Section Summary: Explainability in Email Live Tracking gives IT teams visibility into why an email was judged safe or suspicious, helping analysts troubleshoot false positives and contested verdicts faster.

AI.MY Brings Three-Question Micro-Quizzes to Microsoft Teams​

Traditional security awareness training suffers from a well-documented retention problem: employees click through a mandatory 20-minute video module once a quarter, pass a multiple-choice quiz ten seconds later, and promptly forget the lesson by Tuesday morning.

Hornetsecurity is attempting to close that gap by connecting its Security Awareness Service with AI.MY, the platform's AI Cyber Assistant, directly inside Microsoft Teams.

Instead of relying solely on standalone browser portals, AI.MY acts as an automated "Awareness Coach" within the enterprise chat app where users already spend their workday:

1. Following a completed e-learning session, AI.MY reaches out to the employee directly in Microsoft Teams.
2. The assistant asks three questions tailored to that specific user's current awareness profile.
3. The employee receives immediate feedback in the chat window, and their answers dynamically update their internal knowledge profile so administrators can track learning progress and pinpoint lingering training gaps.

Bringing reinforcement quizzes into Teams is a sensible way to reduce friction, though IT and compliance officers in regulated industries (especially in Europe, where works councils closely scrutinize employee performance tracking) will want to review the privacy architecture. The release does not specify how individual knowledge profiles are scored, what granular employee performance data is visible to management, or what data retention policies govern AI.MY chat interactions.

Section Summary: Through the AI.MY assistant, Hornetsecurity's Security Awareness Service now follows up with employees in Microsoft Teams after e-learning sessions using a targeted three-question quiz to measure and reinforce retention.

A Conversational Assistant for the MSP Control Panel​

The final piece of the Q4 2026 rollout is aimed squarely at the people running the consoles. Within the 365 Total Protection Control Panel, Hornetsecurity is introducing a conversational AI Cyber Assistant Agent—scheduled for its first live demonstration at the it-sa trade fair in Nuremberg from October 27 to October 29, 2026.

The Control Panel agent serves two distinct roles:

• Operational and Product Support: It assists internal IT administrators and MSP technicians with tenant onboarding, policy configuration, day-to-day product usage, and security operations, cutting down the time spent digging through documentation or opening support tickets.
• MSP Sales and Portfolio Consultation: For channel partners, the agent helps map specific customer pain points to modules within the Hornetsecurity portfolio, recommending protection upgrades and helping MSPs standardize their client consultations.

Importantly, based on the company's disclosures, this Control Panel agent functions as a conversational guide and recommendation engine—not an autonomous agent that rewrites tenant firewall rules or alters security configurations on its own.

Section Summary: The new AI Cyber Assistant Agent inside the 365 Total Protection Control Panel provides conversational help for onboarding and troubleshooting while helping MSPs match client security gaps to product modules.

Practical Evaluation Checklist for Microsoft 365 Admins​

Because vendor press announcements naturally highlight best-case workflows while leaving licensing and plumbing details for the documentation pages, Microsoft 365 administrators and MSPs evaluating Hornetsecurity's Q4 2026 release should ask their account representatives five concrete questions before rolling these features into production:

1. Licensing and Tier Placement: Which specific 365 Total Protection bundles or standalone add-on SKUs include Tenant Risk Exposure, Email Live Tracking Explainability, and the Teams AI.MY Awareness Coach?
2. Microsoft Graph API Permissions: What level of Entra ID and Microsoft Graph application permissions does 365 Permission Manager require to audit and automatically remediate permissions across SharePoint, OneDrive, and Teams?
3. Automated Remediation Guardrails: When using Tenant Risk Exposure shortcuts to fix anonymous links or inactive guests automatically, can administrators configure approval workflows, exclusions, or rollback points to avoid breaking active external partner collaborations?
4. Data Boundaries for the Control Panel Agent: Which underlying language model powers the Control Panel AI Cyber Assistant Agent, and does it process tenant-specific telemetry or strictly query product documentation and configuration metadata?
5. Employee Telemetry Governance: Can administrators anonymize or aggregate the knowledge profiles generated by AI.MY in Microsoft Teams to satisfy regional workplace privacy regulations?

Getting your Microsoft 365 permission house in order before turning loose enterprise AI tools is mandatory hygiene in 2026. Tools that surface forgotten guest accounts, public groups, and anonymous links in a single pane of glass can save hours of PowerShell scripting—provided administrators verify how those tools authenticate, classify risk, and execute changes under the hood.