In short
Managed email security services combine an email security product with the people to run it: policies, quarantine and release requests, phishing reports, DMARC and account takeover alerts. Forever Systems manages products from Check Point, IRONSCALES, Perception Point, Sophos, Cisco, Bitdefender and Proofpoint, and can add vendor incident response for email threats.
Get a quote for managed email security
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What a managed email security service covers
Built-in filtering in Microsoft 365 stops a great deal, but targeted phishing, invoice fraud and messages from genuinely compromised accounts still reach users. Specialist email security products add more detection layers, and a managed service makes sure they are tuned and their findings acted on. Typical scope:
- Policy: anti-phishing, impersonation, attachment and link protection set for how your organisation actually uses email
- Quarantine and release: handling requests to release held messages, and deciding what users may release themselves
- Phishing reports: a report button for staff, with reported messages investigated and removed from every mailbox if malicious
- Account takeover: alerts on unusual sign-ins, new forwarding rules and other signs a mailbox has been compromised
- DMARC: SPF, DKIM and DMARC set up and moved towards enforcement, so your domain is harder to spoof
- Incident response: vendor analysts investigating email threats, where the product or service includes it
The exact split of tasks between you, the vendor and Forever Systems is agreed at quote. Forever Systems does not run its own SOC; where 24/7 investigation is part of the service, it is the vendor's.
Email security products we manage
Products differ mainly in how they connect to your mail and in who investigates incidents. API-based products connect to Microsoft 365 directly with no change to mail routing; gateways sit in front of your mailboxes and need an MX record change.
| Product | How it connects | Editions | Who investigates |
|---|---|---|---|
| Check Point Email Security (formerly Harmony Email and Collaboration, and Avanan) | API, inspecting mail after Microsoft's filtering and before the inbox | Advanced Protect or Complete Protect; Email Only, or Email and Collaboration apps such as Teams, OneDrive and SharePoint | Check Point MDR can cover email alongside endpoint, network, cloud and identity |
| IRONSCALES | API with Microsoft 365 | Email Protect, Email Protect Pro, Complete Protect | Email Protect Pro includes an incident management service in which IRONSCALES analysts investigate and remediate |
| Perception Point (now part of Fortinet) | Inline before delivery, or the Microsoft API | Advanced Email Security, optionally with browser and Microsoft collaboration security | Every subscription includes a 24/7 managed incident response service |
| Sophos Email | Gateway, or API integration with Microsoft 365 | Sophos Email, Sophos Email Plus (includes DMARC Manager) | Shares telemetry with Sophos XDR and Sophos MDR |
| Cisco Secure Email | Secure Email Gateway, or Secure Email Threat Defense for Microsoft 365 | Gateway, Threat Defense, Encryption Service | Backed by Cisco Talos threat intelligence; connects to Cisco XDR for investigation |
| Bitdefender Extended Email Security | MX perimeter, Microsoft 365 API, or both | Add-on to Bitdefender GravityZone | Managed in the same console as GravityZone endpoints |
| Proofpoint Essentials | Cloud email gateway | Business, Advanced, Professional, each with a plus version | Per-user quarantine digests; managed by us or your team |
The table describes each option; it is not a ranking. If you already own one of these, we can usually take over its management. If you are starting fresh, we recommend based on your mail platform, how much of the investigation you want handled for you, and whether you also need encryption, archiving or continuity.
Not sure which edition fits? Ask us
Tell us what you need and we will recommend the right edition for your organisation, with a quote.
Who investigates when something gets through
This is the question that separates a product from a service. There are three common models:
- Vendor incident response included. Perception Point includes a 24/7 managed incident response service in every subscription, and IRONSCALES Email Protect Pro includes analyst-led incident management.
- Email inside a wider MDR service. Check Point MDR covers email alongside endpoints, network, cloud and identity, and Sophos Email shares telemetry with Sophos MDR, so email threats are investigated in context.
- Managed by people you nominate. With products that do not include analyst cover, alerts and user reports go to your IT team and, where agreed, to Forever Systems in the hours set out in your quote.
Many organisations combine models: an API product with automatic remediation for the bulk of threats, and an MDR service for the attacks that start in email and move on to endpoints and identities. See managed XDR for services that join those signals up, and managed ITDR for compromised accounts.
Business email compromise and payment diversion
Business email compromise (BEC) does not need malware. An attacker impersonates a director or supplier, or takes over a real mailbox, and asks for a payment or a change of bank details. Filters that look for malicious links and attachments can miss it, which is why the products above look at behaviour: who normally writes to whom, how they write, and whether a sign-in or mailbox rule looks out of character.
Technology helps, but process closes the gap. We recommend that any change of payment details is confirmed by a second channel, using contact details you already hold, not those in the email. Staff who know what BEC looks like are more likely to pause; business email compromise training on our security awareness site covers it. Law firms, property and finance teams are frequent targets; see cyber security for law firms and cyber security for financial services.
Is managed email security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
DMARC and domain protection
Email security also means stopping others sending email that pretends to come from you. SPF, DKIM and DMARC let receiving servers check that a message claiming to be from your domain really is. Moving to a DMARC policy of quarantine or reject takes care: every legitimate service that sends as your domain, from your CRM to your payroll provider, must be identified and authenticated first.
Several products we manage include or offer DMARC tooling: DMARC Manager is included in Sophos Email Plus (and an add-on for Sophos Email), Check Point offers DMARC Management as an Email Security add-on, and IRONSCALES offers DMARC management licensed per domain. As part of a managed service we can read the DMARC reports, find unauthenticated senders and step the policy up when it is safe to do so.
Choosing a managed email security service
The right service depends less on detection claims, which every vendor makes, and more on fit:
- Your mail platform: API products suit Microsoft 365; gateways also suit on-premises or mixed mail systems
- Mail flow: whether you are comfortable changing MX records, or prefer no change to routing
- Investigation: whether you want vendor analysts to handle incidents, or have people who can
- Extras: encryption, data loss prevention, archiving and continuity, which some products include and others sell separately
- Your other security: an email product from the same vendor as your endpoint or MDR service can share signals and a console
- Training: whether you also need phishing simulation and managed security awareness training
Email security is one of our managed security services, and works best alongside managed endpoint security, because a phishing email that slips through usually ends on a laptop.
How onboarding works
A typical move to managed email security with Forever Systems:
- Review your mail platform, current filtering, mail flow, DNS records and the threats users are reporting.
- Recommend a product and connection method, explaining what changes and what stays the same.
- Connect in monitor mode where the product supports it, so we can see what it would catch before enforcing.
- Enforce policies, deploy the report button and set up user quarantine digests.
- Agree escalation: who handles release requests, user reports and confirmed incidents, and what the vendor's analysts do where included.
- Review findings with you at agreed intervals and adjust policies as threats change.
Pricing is per user for most products, with differences in how shared mailboxes are counted, so ask us for a quote. Contact us to discuss your email security.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What are managed email security services?
Managed email security services combine an email security product with the people to run it: policy, quarantine and release, phishing report handling, account takeover alerts, DMARC and incident response. Forever Systems manages the product and escalation; where 24/7 investigation is included, the vendor's analysts provide it.
Is Microsoft 365's built-in email security enough?
It stops a lot, but targeted phishing, invoice fraud and messages from compromised supplier accounts still get through. API-based products such as Check Point Email Security and IRONSCALES add detection layers on top and can remove a malicious message from every mailbox after delivery.
What is the difference between an email gateway and API email security?
A gateway sits in front of your mailboxes and needs an MX record change, so mail is filtered before it arrives. API email security connects to Microsoft 365 directly, needs no change to mail routing, can see internal mail and can remove messages after delivery. Some products offer both.
Which email security products include incident response?
Perception Point includes a 24/7 managed incident response service in every subscription. IRONSCALES Email Protect Pro includes analyst-led incident management. Check Point MDR covers email as part of a wider MDR service.
How much do managed email security services cost?
Most products are licensed per user, with options such as encryption, archiving or incident response changing the cost. Ask us for a quote and we will compare options for your mailbox count.
Still have a question about managed email security?
Ask us and a member of our team will reply by email.