Managed Email Security for small and medium businesses
Prevention-first protection on top of Microsoft 365 or Google Workspace, plus the people who review the quarantine, handle release requests and investigate what gets through. The license and the service, one price, starts at $6.40 per user per month. Nationwide, including Washington DC, Northern Virginia, and Maryland.
Built on Check Point Email Security (formerly Avanan and Harmony Email & Collaboration).
What your managed email security covers on Microsoft 365 or Google Workspace
The managed service runs on the full threat-protection tier of the email security license, connected through the tenant's API, no MX change, checking mail before it reaches the inbox.
Phishing and impersonation
Incoming and internal mail is checked for lookalike senders, spoofed display names and payment-change requests.
Known malware
Attachments and links are matched against known threats and blocked before delivery.
Zero-day attachments
Unknown files are opened in a sandbox first and watched for what they do.
Attachment cleaning
A cleaned copy of the file is delivered in seconds; the original is available on request once it checks out.
Links checked at click time
Links are rewritten and tested when clicked, and unknown pages are emulated before your browser loads them.
Account takeover detection
Unusual logins, new forwarding rules and odd sending patterns are flagged as signs a mailbox has been taken over.
Unauthorized app detection
Third-party apps connected to your tenant are surfaced so you can decide what stays.
Internal mail included
Mail between your own staff is checked too, so a compromised account cannot spread phishing unseen.
Check Point was named a Leader in the 2025 Gartner Magic Quadrant for Email Security (Check Point).
The built-in filter is for the basics. We cover what passes it.
Microsoft's own service description says Exchange Online Protection covers "basic email threats" and its built-in features "prevent broad, volume-based, known email attacks"; zero-day phishing and business email compromise protection sit in Defender Plan 1, included with Business Premium and an add-on for Basic and Standard. Google says Gmail blocks more than 99.9% of spam, phishing and malware. Both deserve respect. The fraction that passes is where the losses are: the FBI counted 24,768 business email compromise complaints and $3.05 billion in reported losses in 2025. Keep the built-in filter on; judge a dedicated layer by what it catches behind it.
What a held email looks like
Day to day, and around the clock
The platform blocks around the clock on its own. Our team reviews, releases and investigates seven days a week, and support is 24/7.
- Investigate whatever gets through, and the phishing your staff report, with no cap on the time spent.
- Pull a reported email from the inboxes it reached, then block the sender.
- Verify a suspicious release request with the sending company before approving it; if they cannot be reached right away, the message stays held until they confirm, and you are kept posted.
- Review what was held and release what belongs to you, seven days a week.
- Handle release and restore requests from your staff through the daily digest.
- Manage allow and block lists and keep the policy tuned as threats change.
- Change your tenant settings only with your approval.
- Send a written monthly summary you can share with your insurer and board.
- Deliver a SaaS security posture report of your tenant in the first 90 days, no charge.
- Two-session onboarding, no onboarding fee, 24/7 support.
How it works, start to finish
Connect
A 15-minute call, then we connect to your tenant through its API in Monitor only. No change is made and no MX record is touched.
Assess
Two weeks of live mail observed. You get a report of what was flagged, what the built-in filter had already passed, and what we would have done with each item.
Onboard
Session one: policies, allow and block lists, who receives the daily digest. Session two: Protect mode on, and your team walked through the digest and release requests.
Protect
Mail is checked before the inbox. Held items are reviewed and released seven days a week; the investigation of what gets through has no time cap.
Report
A written monthly summary for your insurer and your board, and a SaaS security posture report of your tenant in the first 90 days.
License only, or managed by us
License only
- The license and API connection to your tenant
- Your written quote beaten, like for like, on a quote dated within 30 days
- Free trial first, two weeks in Monitor only
- Monthly check-in with reports and a run-through of new releases
- Renewal heads-up 30 days out, no year-end clock
- Your IT team runs the policy, the quarantine and the investigations
Managed by cAIberOps (SY-ber-ops)
- The license and API connection to your tenant
- Policy setup, allow and block lists, digest recipients
- Quarantine review and releases, seven days a week
- Investigation of what gets through, no time cap
- Reported phishing pulled from inboxes, sender verified with their company before release
- Written monthly report for your insurer and board
- SaaS security posture report in the first 90 days
- 24/7 support
Why cAIberOps (SY-ber-ops)
Behind this service is a team that has triaged more than 1,000 held emails and made more than 100 verification calls to the companies that sent them. On those calls, a majority of the senders learned for the first time that their own account had been compromised; the release request from your staff was the only sign.
That is the difference between a license and a managed service: the filter holds the message, a person checks whether the sender is who they say they are, by phone if it takes a phone call.
No tier-one queue. A release request, an email or a phone call puts you with the engineers who do the work, not a ticket that climbs toward one.
One price, license and service included
Managed Email Security
20% off (30% for registered 501(c)(3) nonprofits) on a 12-month Managed Email Security agreement signed by December 31, 2026, new customers only, no onboarding fee.
Email + Endpoint Bundle
Starts at $12.40 per user per month, includes one endpoint per user. Additional endpoints $8 per endpoint per month. Saves $2 per user versus buying separately; one monthly report across both.
License only
Like for like: a tier with the same capabilities, the same device or user count, the same term, from the vendor you use or are about to buy; written quote dated within 30 days, license compared with license. Free trial first, monthly check-in, renewal heads-up 30 days out.
Options such as Security Awareness Training and Dark Web Monitoring are added to the managed service and quoted on the call. No setup or onboarding fee. No multi-year contracts. Monthly prices, billed yearly.
Why the price starts at $6.40: you choose the coverage
The starts-at price covers the full threat-protection tier for email plus the managed service. As an authorized Check Point partner we can add the rest of the vendor's email catalogue to your agreement; each option is quoted on your user count.
Included at the starts-at price
- Phishing and impersonation
- Known malware
- Zero-day attachments
- Attachment cleaning
- Links checked at click time
- Account takeover detection
- Unauthorized app detection
- Internal mail included
- Managed service, monthly report, 24/7 support
Optional, quoted on request
- Collaboration and file-sharing coverage: OneDrive, SharePoint, Google Drive, Dropbox, Box, Citrix ShareFile, Teams and Slack
- Complete Protect: email data loss prevention, misdirected-email prevention and encryption
- Email archiving, retention up to 10 years
- DMARC management
- Continuous SaaS security posture management: a running check of your Microsoft 365 or Google Workspace settings, such as MFA gaps, risky admin rights, external sharing and connected third-party apps, with fixes flagged as they appear.
- Security Awareness Training
- Dark Web Monitoring (leaked credentials)
Add-ons are added to the managed service, not sold alone. Monthly prices, billed yearly.
Email security questions
What is managed email security?
A dedicated protection layer on top of Microsoft 365 or Google Workspace, run by a provider: the filtering license plus the people who review the quarantine, handle release requests and investigate what gets through. cAIberOps (SY-ber-ops) provides both for one per-user price.
Is this the same as Avanan?
Yes. Avanan became Check Point Harmony Email & Collaboration after Check Point acquired it, and in March 2026 Check Point renamed it Check Point Email Security. Same platform, same API connection to your tenant.
What will my staff notice?
A daily digest of what was held, with a one-click release request. The rest of their mail is unchanged.
How long does a release request take?
A clear-cut case is released the same day. If the message looks like a payment change or a lookalike sender, we confirm with the sending company by phone first; when they are not reachable, we leave a message, keep the email held and tell you where it stands. No message is released on your behalf until the sender confirms.
What is in the posture report?
A one-time review of your tenant within the first 90 days: MFA and conditional access, admin and emergency accounts, external forwarding and sharing, allow lists, third-party app permissions, and SPF, DKIM and DMARC. No charge.
What access does the assessment need?
The assessment connects through your Microsoft 365 or Google Workspace tenant's app consent. In Monitor mode it analyzes mail and makes no changes: no quarantine, no delay, no MX change. You can remove the app from your admin center at any time, and we remove the connection at the end if you do not continue.
Does this replace Microsoft Defender or Google's filter?
No. The built-in filter stays on. Our layer connects through the tenant's API after the native filter has done its work, and we judge it by what it catches behind the filter.
What does the license tier include, and what is optional?
The starts-at price includes the full threat-protection tier for email: anti-phishing on incoming and internal mail, known malware blocking, sandboxing of unknown attachments, attachment cleaning, click-time link checks, account takeover detection and unauthorized app detection. Collaboration and file-sharing coverage, data loss prevention, archiving, DMARC management and posture management are optional and quoted on request.
What happens to a quarantined message we needed?
Your staff request a release from the digest; we approve it seven days a week. Quarantined mail is kept for 180 days on our platform, so no message disappears while a request waits.
Can our IT provider keep managing email if we buy only the license?
Yes. That is the license-only route: we beat your written quote like for like, and your provider runs it.
Do nonprofits pay less?
Yes. Registered 501(c)(3) nonprofits pay $5.60 per user per month on Managed Email Security. Monthly prices, billed yearly.
See your own mail first. Two weeks, Monitor only, no charge.
The assessment ends with a report of what the native filter passed and what we would have done with each item. You decide what happens next.