Email Security 365
Core protection: incoming and outgoing mail checks, sender authentication, quarantine and archiving.
Where the module helps during an attack
Email protection primarily addresses initial attacker contact and financial fraud. This is an indicative view, not a measurement.
| Area | Level |
|---|---|
| Reconnaissance | no direct role |
| Initial access | primary role |
| Execution and persistence | context |
| Escalation and lateral movement | context |
| Impact | additional protection |
| Investigation and recovery | additional protection |
Check mail before it reaches the reader
Email Security checks incoming and outgoing mail for spam, phishing, malicious attachments and links, and authenticates senders using SPF, DKIM and DMARC. Suspicious messages enter quarantine and users receive summaries.
The vendor supports Microsoft 365 and Google Workspace. The base variant includes mail archiving for up to one year.
Email Security 365 ICES
Microsoft 365 integration through Exchange connectors without MX changes, with events in Threat-hunting & Action Center.
ATP and Fraud Prevention
Adds sandboxing, deep attachment inspection, post-delivery alerts and BEC fraud detection.
Fraud often needs no malware
An attacker impersonates a director or supplier and requests payment to a new account. The message may contain no malware. Fraud Prevention analyses normal business communication patterns and flags deviations.
The vendor describes language analysis, bank account and IBAN checks, and monitoring of attachment and link changes. Messages can be flagged retrospectively when new information emerges after delivery.
- Executive or supplier impersonation (CEO fraud, BEC).
- Altered invoices and payment details.
- Credential theft through fraudulent links.
- Unusual sender or mailbox behaviour.
Complement existing protection
The module suits businesses adding to Microsoft 365 or Google Workspace's built-in protection. The vendor also offers Fraud Prevention alongside existing mail filtering.
Accounting, purchasing and management teams handling payments and sensitive documents particularly benefit.
IT
Quarantine, logs and forensic message details in one console.
Finance and purchasing
Alerts about suspicious payment detail changes and altered invoices.
Management
Lower risk of successful executive impersonation.
Deployment with APPSEC
Heimdal operates the cloud service and detections. APPSEC designs and configures the solution as agreed. You manage domains and the tenant and decide quarantine policies.
Variant selection
We select Email Security 365, ICES or ATP with Fraud Prevention based on your platform, risks and existing protection.
Mail flow
We prepare MX changes, connectors or Graph API consent and a rollback plan.
Pilot
We verify protection on selected mailboxes and refine quarantine and exceptions.
Users
We prepare concise guidance for quarantine summaries and suspicious message reporting.
Things to consider
- MX changes affect mail delivery. We schedule them for a quiet period with rollback available.
- SPF, DKIM and DMARC should be checked before deployment.
- The vendor licenses active mailboxes. Counting rules vary by integration method.
- No filter catches every fraud attempt. Verify changed payment details through another channel.
