In short
Advanced email threat protection is the set of controls beyond basic spam filtering that stops targeted attacks: sandboxing for unknown attachments, time-of-click link analysis, behavioural AI for business email compromise, impersonation and account takeover detection, and removal of malicious mail after delivery. It works alongside the built-in protection in Microsoft 365 and Google Workspace.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What advanced email threat protection adds
Basic filtering looks for known bad things: senders with poor reputation, attachments that match malware signatures and messages that look like bulk spam. It is necessary, and Microsoft 365 and Google Workspace both include it. The attacks that cost organisations money are built to slip past it:
- Unknown attachments: new malware that no signature matches yet, caught by opening the file in a sandbox and watching what it does
- Delayed and hidden links: pages that turn malicious after the email is delivered, or sit behind redirects, shortened URLs and QR codes, caught by checking the link when it is clicked
- Payload-free fraud: a plain request to pay an invoice or change bank details, with nothing to scan, caught by behavioural and language analysis
- Impersonation: a lookalike domain or a director's name on a free webmail address, caught by impersonation and display-name checks
- Compromised accounts: real mailboxes used by attackers, caught by account takeover detection that spots unusual sign-ins, rules and sending
- What slips through anyway: caught after delivery by removing the message from every mailbox that received it, often triggered by a staff report
Advanced email threat protection is the name for these layers together. Some come with your Microsoft or Google licence, and the rest come from an integrated cloud email security product, a secure email gateway, or both.
Email threats mapped to the controls that stop them
Use this table to see which control matters most for each threat, then follow the link for the detail.
| Threat | What it looks like | Controls that stop it | Read more |
|---|---|---|---|
| Phishing | Links to fake Microsoft or Google sign-in pages, malicious attachments, fake delivery or document-share notices | Link analysis at click time, sandboxing, warning banners, report button, post-delivery removal | Phishing protection |
| Business email compromise | A plain-text request from a director, supplier or adviser to pay, change details or send data | Behavioural and language AI, impersonation protection, DMARC, account takeover detection, payment checks | BEC attack |
| Invoice fraud | A fake invoice or a "we have changed banks" email, often in a real thread | Supplier impersonation and lookalike-domain detection, external banners, verification process | Invoice fraud |
| Whaling | Targeted fraud aimed at, or sent as, directors and senior finance staff | VIP impersonation protection, display-name checks, monitoring of executive mailboxes | Whaling attack |
| Spoofing | Mail forged to look as if it comes from your domain or a trusted one | SPF, DKIM and DMARC on your domain; spoof intelligence and impersonation checks inbound | Email spoofing |
| Account takeover | A real mailbox signed in to by an attacker and used to phish or redirect payments | Phishing-resistant MFA, sign-in and inbox-rule alerts, account takeover detection | Email account takeover |
| Ransomware | Attachments or links that install malware, or stolen credentials that give remote access | Sandboxing, attachment sanitisation, URL analysis, post-delivery removal, then endpoint and backup | Ransomware email |
| QR code phishing | A QR code in an email or attachment that leads to a credential-harvesting page on a phone | Image and QR code analysis in the email layer, plus staff awareness | QR code phishing on our training site |
The same control often covers several threats. Post-delivery removal, for example, helps with phishing, ransomware and BEC alike, which is why an API-based product that can remove mail after delivery is worth considering as a second layer for Microsoft 365 and Google Workspace.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
What Microsoft 365 and Google Workspace already cover
Microsoft 365. Every cloud mailbox gets Microsoft's built-in protection, known as Exchange Online Protection: anti-malware, anti-spam, spoof intelligence, quarantine and zero-hour auto purge, plus a first contact safety tip and indicators for unauthenticated senders. Microsoft Defender for Office 365 Plan 1 adds Safe Links, Safe Attachments and impersonation protection for named users and domains, with mailbox intelligence that learns who each person normally emails. Plan 2 adds investigation and response tools. Our Microsoft 365 phishing protection guide covers the policies to set.
Google Workspace. Gmail filters spam, phishing and malware for every edition. Administrators can also switch on advanced phishing and malware protection, which includes settings to protect against encrypted attachments and attachments with scripts from untrusted senders, identify links behind shortened URLs, scan linked images, warn on clicks to untrusted domains, and protect against similar domain names, spoofing of employee names and unauthenticated email. Google's Security Sandbox, which opens attachments in a virtual environment, is supported in Business Standard, Business Plus, Enterprise Standard, Enterprise Plus and Frontline Plus. See Google Workspace email security and Gmail security settings.
Configuring these well is the first step for any organisation, and it costs nothing extra.
Where a third-party layer helps
Built-in protection has limits that matter for targeted attacks:
- A message from a genuine supplier whose mailbox has been compromised passes every authentication check, so only behavioural analysis of the content and the relationship is likely to catch it
- Phishing sent internally from a compromised colleague's account is not seen by a gateway in front of your mail, but is seen by an API-based product inside the tenant
- Attackers also use Teams, Slack and shared files as well as email; some products cover these from the same console
- Organisations that run Google Workspace alongside Microsoft 365 often want one policy and one console across both
- Handling staff reports by hand is slow; several products cluster similar reports and remove every copy of a confirmed threat
Read ICES vs SEG for the architecture choice, or compare every option on email security platforms compared.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Threat protection in the platforms we supply
We supply several email security platforms, so we can match the controls to the threats you actually see. These descriptions come from each vendor's own material; we do not publish catch rates or rankings.
| Platform | How it connects | Threat controls the vendor describes | Gmail |
|---|---|---|---|
| Check Point Email Security (formerly Harmony Email & Collaboration, originally Avanan) | API, monitor mode to inline prevention | Phishing, BEC and impersonation, account takeover, sandboxing and file sanitisation; Teams, file sharing and Slack too | Yes |
| IRONSCALES | API, no MX change | AI detection of phishing, BEC, VIP impersonation and QR code attacks; automatic removal from every affected mailbox; account takeover protection for Microsoft 365 in higher plans or as an add-on | Yes |
| FortiMail Workspace Security (formerly Perception Point) | ICES, no MX change | Dynamic scanning of every file and URL, anti-BEC and account takeover, VIP protection | Yes |
| Acronis Email Security | API for Microsoft 365, no MX change | Powered by Perception Point: phishing, BEC, account takeover, spoofing, malicious links and attachments, zero-days | Yes |
| Vade for M365 and Vade for Google Workspace | API, no MX change | AI anti-phishing using computer vision on logos and QR codes, anti-spear-phishing with natural language processing, auto-remediation | Yes |
| TrendAI Vision One Email and Collaboration Security (Trend Micro) | API with optional inline mode, MX gateway, or both | Phishing, QR code phishing, BEC, account takeover and ransomware; writing style analysis | Yes |
| Sophos Email | Gateway or Microsoft 365 API | Impersonation and BEC protection, sandboxing, time-of-click URL protection, QR code detection, clawback after delivery | Yes |
| Proofpoint Essentials | Cloud gateway (MX) | Spam and phishing engine, multi-layer anti-virus, URL Defense and Attachment Defense depending on package | Confirmed at quote |
| Bitdefender GravityZone Extended Email Security | MX perimeter, Microsoft 365 API, or both | Phishing, BEC, impersonation and malware, with post-delivery remediation through the API | Confirmed at quote |
| Symantec Email Security.cloud | Cloud gateway (MX) | Anti-spam with BEC detection, multi-scanner anti-malware with link checking | Yes |
| ThreatDown Email Security | API, no MX change | Adaptive AI, anomaly detection and automatic remediation, managed in the ThreatDown console | Confirmed at quote |
Vendor pages on this site cover each product in more depth, for example Acronis Email Security, Vade for M365 and ThreatDown Email Security.
How we help
We start from the threats you are actually seeing rather than a product list. We can:
- Review recent phishing, fraud attempts and staff reports to see which controls would have stopped them
- Check your Microsoft 365 or Google Workspace threat policies and your SPF, DKIM and DMARC records
- Run an API-based product in monitoring mode alongside your current protection, where the product supports it, so you can see what it would add on your own mail
- Recommend, license and deploy the option that fits, with package contents confirmed at quote
Pricing depends on the product, package and number of users or mailboxes, so ask us for a quote. Contact us to talk through your email threats.
Email threats and how to stop them
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is advanced threat protection in email?
It is the set of controls that stops targeted attacks a basic spam filter misses: sandboxing of unknown attachments, link checks at the moment of click, behavioural analysis for business email compromise, impersonation and account takeover detection, and removal of malicious messages after delivery.
What are the most common email threats to businesses?
Credential phishing, business email compromise and invoice fraud, impersonation of directors and suppliers, account takeover, and malware or ransomware delivered by attachment or link. QR code phishing is used to move the victim onto a phone, away from the protection on their computer.
Is Microsoft Defender for Office 365 advanced threat protection?
Yes. Defender for Office 365 was previously called Office 365 Advanced Threat Protection. Plan 1 adds Safe Links, Safe Attachments and impersonation protection to the built-in filtering, and Plan 2 adds investigation and response tools.
Does Google Workspace have advanced threat protection for email?
Gmail includes advanced phishing and malware protection settings that administrators can switch on, and the Security Sandbox in Business Standard, Business Plus, Enterprise and Frontline Plus editions. Several third-party products add a further API layer for Gmail.
Do I need email threat protection if I already have a secure email gateway?
A gateway filters mail before it arrives but usually cannot see internal mail or remove a message once delivered. Many organisations add an API-based layer for post-delivery removal, internal phishing and account takeover detection.
Still have a question about email threat protection?
Ask us and a member of our team will reply by email.