In short
ThreatDown Email Security is the email protection add-on from ThreatDown, Malwarebytes' business brand. It uses adaptive AI, with natural language analysis, anomaly detection and crowdsourced threat intelligence, to stop phishing and business email compromise, and removes threats automatically. It connects without MX changes or agents and is managed in the same ThreatDown console as endpoint security.
Get a quote for ThreatDown Email Security
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What ThreatDown Email Security is
ThreatDown is the business brand of Malwarebytes, known for its endpoint protection, EDR and managed detection and response. ThreatDown Email Security extends that platform to the inbox. Rather than sitting in front of your mail as a gateway, it connects to your cloud email through an API integration, so mail keeps flowing as it does today.
ThreatDown sums up the deployment as no MX record changes, no agents, no separate console and no manual tuning. For an organisation that already runs ThreatDown on its laptops and servers, that means email threats appear next to endpoint alerts in the console you already use, with no new portal to learn. Our sister site's ThreatDown guide covers the endpoint side.
How it detects and removes threats
ThreatDown calls its approach Adaptive Email Threat Protection:
- Adaptive AI: natural language processing and understanding read what a message is asking the recipient to do, which is how payload-free business email compromise and invoice fraud are caught
- Anomaly detection: messages that do not fit normal patterns for the sender and recipient are flagged
- Crowdsourced threat intelligence: detections informed by threats reported by a large community of security teams
- Self-learning protection: the models keep adjusting to new attacks rather than relying on fixed rules
- Rapid auto-remediation: AI-based detection, classification and removal of malicious messages from mailboxes after delivery
Because it works inside the mailbox, it complements the filtering built into your mail platform rather than replacing it. It is an example of integrated cloud email security, the API-based model.
One console for endpoint and email
The practical advantage of ThreatDown Email Security is consolidation. ThreatDown manages endpoint security and email security together in the same cloud console for monitoring, detection and response. That helps in three ways:
- Correlation: a phishing email and the endpoint it reached can be looked at together, rather than in two tools.
- Fewer logins: small IT teams and IT providers work from one console and one set of alerts.
- One supplier: licences for endpoint and email sit on the same subscription and the same Forever Systems invoice.
If you already use ThreatDown endpoint protection, EDR or MDR, adding email is usually the quickest route to API-based mail protection. If you do not, compare it with other platforms first; an email product chosen on its own merits may suit you better.
Is ThreatDown Email Security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Deploying ThreatDown Email Security
ThreatDown says deployment takes a few clicks. You need an administrator account on your mail platform able to grant the API connection. ThreatDown does not publish a list of supported mail platforms on its product page, so we confirm that yours, such as Microsoft 365, is supported, and review the permissions requested, when we scope.
Our usual rollout:
- Connect the service to your mail platform and agree who receives alerts.
- Review the first detections with you and check for false positives on legitimate senders such as finance and marketing systems.
- Agree which threats are removed automatically and how users report suspicious mail.
- Agree how release requests are handled and who handles them.
What it does not cover
ThreatDown Email Security is focused on inbound threats in the mailbox. It is not a gateway, so it does not provide:
- Pre-delivery filtering for on-premises mail: compare a secure email gateway such as Symantec Email Security.cloud
- Encryption: see send secure email for the options
- Continuity or archiving: gateways such as Proofpoint Essentials cover those
- Protection for your own domain: your SPF, DKIM and DMARC records still need to be in order to stop others spoofing you; see email authentication
None of these are criticisms; they are simply outside the product's scope, and knowing them helps you plan the rest of your email security.
Working alongside Microsoft 365 or Google Workspace protection
ThreatDown Email Security does not replace the protection built into your mail platform. In Microsoft 365, Exchange Online Protection and, where licensed, Defender for Office 365 still filter mail first; in Google Workspace, Gmail's own filters and the options in our Gmail security settings guide do the same. ThreatDown then inspects what reaches the mailbox and removes what it judges malicious.
That layering is why it is worth reviewing your built-in settings at the same time. A well-configured platform filter leaves the API layer to concentrate on the targeted messages that matter, such as supplier impersonation and credential phishing, and reduces the number of alerts your team sees.
How it compares with other endpoint-vendor email products
Several endpoint vendors we supply now offer email protection managed in their own console. If you are choosing between them, the differences are mostly about connection model and platform support:
| ThreatDown Email Security | Bitdefender Extended Email Security | Acronis Email Security | Trend Micro Email and Collaboration Security | |
|---|---|---|---|---|
| How it connects | API, no MX change | MX perimeter, Microsoft 365 API, or both | API for Microsoft 365, no MX change | API with optional inline mode, MX gateway, or both |
| Managed in | ThreatDown console | GravityZone console | Acronis Cyber Platform | TrendAI Vision One console |
| Google Workspace | Confirmed at quote | Perimeter mode, confirmed at quote | Yes | Yes |
| Gateway option | - | Yes | - | Yes |
| Basis through us | Per mailbox, monthly | Add-on to GravityZone, confirmed at quote | Monthly on usage | Per user, monthly in arrears |
| Read more | This page | Bitdefender email security | Acronis Email Security | Trend Micro email security |
The usual rule is simple: if you are happy with your endpoint vendor, its email product is worth a trial first, because the shared console is a real saving. If you are not tied to one, compare all of them in our email security solutions comparison.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How ThreatDown Email Security is licensed
ThreatDown lists Email Security as available with all of its bundles, as an add-on rather than part of the bundle itself. Through Forever Systems it is licensed per protected mailbox and billed monthly, so the invoice follows the mailboxes covered as staff join and leave.
Pricing depends on the number of mailboxes and your existing ThreatDown subscription, so ask us for a quote. The commercial detail is on our licensing site's ThreatDown Email Security licensing page.
Who it suits and how we help
ThreatDown Email Security suits organisations already running ThreatDown on their endpoints that want one vendor and one console for both, and organisations on cloud mail that want extra protection without changing MX records. Small IT teams benefit from automatic remediation, which removes threats from every affected inbox rather than leaving users to delete them.
We can connect the service, run the observation phase with you, tune detections and help with false positives and release requests. Pair it with phishing awareness training to cover the human side, and compare it in our email security solutions comparison. Contact us for a quote.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
Is ThreatDown the same as Malwarebytes?
ThreatDown is Malwarebytes' business brand, covering its endpoint protection, EDR, MDR and related products, including Email Security.
Does ThreatDown Email Security need MX record changes?
No. ThreatDown states it deploys with no MX record changes, no agents and no separate console, connecting to your cloud email through an API integration.
Is email security included in ThreatDown bundles?
It is available with all ThreatDown bundles as an add-on, so it can be added to any ThreatDown subscription rather than being included by default.
Does ThreatDown Email Security work with Google Workspace?
ThreatDown does not list supported mail platforms on its product page, so we confirm support for your platform, whether Microsoft 365 or Google Workspace, before you commit.
How is ThreatDown Email Security licensed?
Through Forever Systems it is licensed per protected mailbox and billed monthly. Ask us for a quote.
Still have a question about ThreatDown Email Security?
Ask us and a member of our team will reply by email.
More email security guides
Bitdefender email securityGravityZone Extended Email Security: MX perimeter filtering, Microsoft 365 API protection, or both, in the GravityZone console.
Acronis Email SecurityPerception Point-powered email filtering for Microsoft 365, Google Workspace and more, managed in Acronis Cyber Platform.ICES explainedHow API-based email security connects after Microsoft's or Google's filtering.Phishing protectionLayered phishing protection for business email: methods, tools and what to compare.