An analyst has been tasked with providing a report that can be used to prioritise investigations based on a user's Attack Index score. Which report…

The "Very Attacked People" (VAP) report is specifically designed to identify and rank individuals within an organization based on their Attack Index score. This score is a weighted composite metric calculated by Proofpoint that considers the volume, severity, and sophistication of threats targeting a user. By listing users with the highest Attack Index scores, the VAP report enables security teams to efficiently prioritize their investigative efforts, focusing on the users who pose the greatest organizational risk.

A: The VIP Activity report focuses on threats against a pre-defined list of important users, not necessarily those with the highest Attack Index across the entire organization.

B: The Top 10 Recipients report is based purely on the volume of email received, which does not correlate directly with the risk level or sophistication of attacks.

D: The Top 10 Clickers report identifies users who have clicked on malicious links. This is a reactive metric of user behavior, not a proactive risk assessment like the Attack Index.

1. Proofpoint, Inc. (2023). Targeted Attack Protection (TAP) Administrator Guide. "Very Attacked People (VAPs)" section. This guide defines the Attack Index and explains that the VAP report is the primary tool for viewing and acting upon this data.

2. Proofpoint, Inc. (2023). Proofpoint Security Awareness Training Datasheet. This document describes how insights from VAP reports can be used to assign targeted training to the most at-risk users, confirming the report's role in risk prioritization.