Check Point Email Security

Why do you need Check Point Email Security?

Email protection is the part of cybersecurity that has to decide within a fraction of a second, and every mistake costs either an incident or a blocked invoice. The decision about an additional layer on top of Microsoft 365 comes down to one question: what should happen to a message that is technically valid because it really did come from a partner’s account.

Business Email Compromise needs no malicious file — a convincing sentence and a credible sender are enough. That is why email protection has to look not only at attachments and links, but also at the sender, the content and the behavior of accounts.

Check Point Email Security is the solution previously known as Check Point Harmony Email & Collaboration. According to the vendor’s documentation, it is a protection service that works via API: a message is sent for analysis to ThreatCloud before it is delivered, and the verdict decides whether it reaches the mailbox or goes, for example, to quarantine. The service also inspects internal and outgoing email and, when needed, removes or modifies messages that have already been delivered. Protection covers Microsoft 365 and Gmail email as well as collaboration apps: Microsoft Teams, SharePoint, OneDrive, Google Drive and Slack.

How does it work?

Anti-Phishing and executive impersonation

The Anti-Phishing engine detects phishing, suspected phishing and spam. According to the documentation, it analyzes, among other things:

• attachments and links, including addresses hidden behind QR codes,
• sender and domain reputation,
• text read from images (OCR),
• executive impersonation — names and addresses of company executives used to get an employee to make a payment or disclose information.

For messages that fail DMARC checks, the administrator can trigger a separate handling workflow.

Anti-Malware and attachment cleaning (CDR)

• Anti-Malware combines antivirus for known malware with the Threat Emulation sandbox (Check Point SandBlast), which opens the file in an isolated virtual machine to detect unknown zero-day threats.
• Attachment Cleaning (Threat Extraction) is a Content Disarm and Reconstruction engine. When an attachment is not malicious, the user receives a safe version of it — without macros, embedded objects, links hidden behind text and other active content — in the same format or converted to PDF.
• The administrator can allow users to retrieve the original themselves, without involving the help desk.

Compromised accounts (Account Takeover)

In the Microsoft environment, the service observes user behavior — login and correspondence patterns — to recognize a compromised account before any damage is done. The account is then blocked automatically by the system or manually by an administrator. The documentation also describes risk assessment of partners whose mailboxes may have been compromised (Partner Risk Assessment).

Key features

Email protection

• Anti-Phishing for incoming and internal email, including spam detection
• Anti-Malware with the Threat Emulation sandbox
• Click-Time Protection — links in the body and attachments are rewritten, and the website is checked at the moment of the click (URL Reputation and URL Emulation)
• Works alongside Microsoft Safe Links, without disabling either mechanism

Collaboration app protection

• Microsoft Teams and Slack — messages and files inspected for malware, phishing and DLP
• SharePoint, OneDrive and Google Drive — scanning of uploaded files
• Box, Dropbox and Citrix ShareFile — among the supported file sharing apps
• Files with detected threats are quarantined

Data Loss Prevention (DLP)

• DLP policies for email, OneDrive, SharePoint, Google Drive, Teams and Slack
• Built-in categories and data types, e.g. personal data (PII) and payment card numbers (PCI)
• Custom data types: regular expressions, dictionaries and compound types
• Prevention of email sent to the wrong recipient (Misdirected Email Prevention)
• Encryption of outgoing email

Deployment and management

• API integration, without MX record changes
• Modes from monitoring only to inline prevention
• Policies and inspection scope limited to selected user groups
• Dashboards, the Security Checkup report and Shadow IT analytics
• Integration with SIEM and SOAR platforms

Who is it for?

• Organizations using Microsoft 365 or Google Workspace
• Companies exposed to phishing, executive impersonation and account takeover
• Teams that share files in Teams, Slack, SharePoint and on shared drives
• Organizations that need to control data leakage through email and collaboration apps

The boundary where the filter stops being enough

The most expensive messages contain no malicious attachment and no suspicious link. They contain a bank account number.

• Supply chain compromise. The message comes from a real account of a real business partner and passes SPF, DKIM and DMARC, because it is authentic. What stops it is a procedure for confirming a change of bank account, not the email gateway.
• Protecting channels beyond email. A file dropped on a shared drive or a link pasted into a chat bypasses the email filter entirely.
• Practicing the response, not just vigilance. An employee needs to know whom to report a suspicion to and how quickly — otherwise the report never gets made.

We test your organization’s resilience to these scenarios with phishing simulations and social engineering tests.

Why deploy Check Point Email Security with nFlo?

Email protection works only as well as the policy it is given and the process that handles its reports. In a Check Point Email Security project, the nFlo team:

• inventories mailboxes, user groups and collaboration apps and determines what the protection will cover,
• designs the policies: Anti-Phishing, protection against executive impersonation, attachment cleaning, DLP and quarantine handling,
• deploys the service via API, starting in monitoring mode and enabling inline prevention after reviewing the results,
• maintains the configuration and analyzes events together with the client’s security team.

Technology cannot replace testing people and procedures. We measure employee resilience with phishing simulations and social engineering tests. Start a conversation about your environment through contact; you can read about nFlo’s cooperation with the vendor on the Check Point page.

FAQ

Does deployment require MX record changes? No. Check Point Email Security connects to Microsoft 365 and Google Workspace via API, without changing MX records. The vendor describes modes ranging from monitoring only to inline prevention, and the documentation describes a Learning Mode in which the service identifies, among other things, the mail servers that process messages before Microsoft or Google. This makes it possible to enable protection in stages.

How does Check Point Email Security detect advanced phishing? The Anti-Phishing engine evaluates many elements of a message: attachments, links, sender reputation, the domain, text read from images (OCR) and addresses hidden behind QR codes. Each verdict has a confidence level, and the administrator sets the threshold at which a message is treated as phishing and below which it is treated as suspected phishing. Links are checked again at the moment of the click (Click-Time Protection), which makes it possible to detect phishing websites that did not yet have a bad reputation when the message was delivered.

Does Check Point Email Security also protect Teams and SharePoint? Yes. According to the documentation, protection covers Exchange Online email (Microsoft 365), Microsoft Teams, SharePoint and OneDrive, and in Google Workspace — Gmail and Google Drive. Slack, Box, Dropbox and Citrix ShareFile are also supported. Messages in messaging apps are inspected for malware, phishing and DLP, and uploaded files for malware and compliance with the DLP policy.

What does licensing look like? The vendor offers packages that cover email only or email together with collaboration apps, at two protection levels; DLP belongs to the higher one. Add-ons are available separately, including email archiving and DMARC management. We agree the scope of the license — apps, protection level and add-ons — before the project.

Will Check Point Email Security block our phishing simulations? According to the documentation, the service automatically recognizes messages from commonly used phishing simulation platforms and automatically declines employee reports about such messages. For a platform not on the vendor’s list, the administrator adds an exception rule (Allow-List) based on the IP address. For phishing simulations run by nFlo, we agree the exception configuration before the campaign.