In our last post we listed what our Managed Email Security includes, item by item. Today is the other side of that page: how to tell whether the email security you already pay for is being managed by anyone, or whether a license was connected once and left alone. You do not need a security background to run this check. You need your inbox, your Junk folder, and twenty minutes with whoever bills you for email protection.
Why this is worth twenty minutes
Per a Gartner survey published September 22, 2026 (297 CISOs or equivalent, surveyed March through May), 79% reported at least one email phishing, spear-phishing or business email compromise incident in the prior 12 months. And the two campaigns we covered earlier this week, EvilTokens and DarkMe, both reached their victims through a message in an inbox. The filter is one layer. The person watching the filter is the other, and that second layer is the one that quietly disappears when nobody is paying attention.
Sign 1: you learn about threats verbally
Your IT person tells you, in the hallway or on a call, which kinds of emails to avoid this month. That is advice, not a service. A managed email security service should be able to show you what it held: a quarantine digest or report listing the messages that were stopped before delivery, who they were addressed to, and why. If the only evidence that something is protecting your inbox is somebody's word for it, ask to see the quarantine from last week. If nobody can produce it, the answer to "who is working the quarantine" is probably nobody.
Sign 2: the inbox is not clean
Look at your own inbox for the past seven days. Count the password-expiration notices that did not come from your own IT, the "document waiting for your signature" messages from a sender you do not recognize, the invoices from a domain that is one letter off from a vendor you pay, and the QR codes. Per Check Point's documentation, its Anti-Phishing engine "analyzes various components of an email, such as attachments, links, sender reputation, domain analysis, OCR, URLs behind QR code, and many more." If those messages are landing in the inbox each week, three questions are worth asking: does the protection level you pay for include an engine that does that kind of analysis, which mode is it running in, and has anyone tuned it since the day it was connected? Each of those is a question with a specific answer, and "tell the staff to be careful" is not one of them.
Sign 3: nobody can tell you the mode
This is the single most useful question to ask your provider: when the engines decide a message is malicious, does it reach the inbox first? There are two common answers. One is that mail is held before delivery. Per Check Point, in Prevent (Inline) mode "the workflow scans the emails prior to delivery to the user." The other is that mail is delivered and then pulled back, which Check Point calls Detect and Remediate. Both are supported Check Point configurations with different trade-offs; the free assessment we run uses Monitor only, a third mode that reports what it sees and quarantines nothing unless an administrator sets a quarantine rule; during the assessment we set none, on purpose. The problem is not the mode. The problem is a provider who cannot tell you which one you are in. If nobody can tell you by the next business day, you have your answer about how closely the service is being watched.
Sign 4: nobody can tell you the protection level
Email security licenses come in tiers, and the tiers are not the same product with a different price. Per Check Point's licensing guide, its Advanced Protect tier "Includes phishing protection, account takeover protection, and protection against known and unknown malicious URLs (URL Emulation) as well as known and unknown malicious files (Sandbox and CDR)." Across the market, lower tiers from various vendors can include anti-phishing and little else; a quote that says "email security" without a tier name is a quote for something unspecified. Ask which tier is on your invoice, and whether attachment sandboxing, click-time link protection and attachment cleaning are part of it. If the provider cannot name the tier, the provider may not know what it sold you.
Sign 5: a held email takes a day to release
Legitimate mail gets held sometimes; that is the cost of a filter that errs toward caution. The test is what happens next. When your bookkeeper's supplier statement lands in quarantine, who releases it, how do they decide it is safe, and how long does it take? In our service, a person answers a release request after looking at the sender and the attachment; support is 24/7, and the routine review of what was flagged against what was delivered happens each business day. Self-service release is a configuration choice, and a reasonable one for some messages. The question is whether anyone reviews what users release and adjusts the policy from it. If staff release their own mail and nobody looks at those releases afterward, half the work is being skipped.
Sign 6: "looks suspicious?" is the whole investigation
A message arrives claiming to be from a supplier with updated bank details. Someone forwards it to IT with "does this look legit?" and IT replies "looks suspicious, delete it." That is a guess, and both the message and the reply could be wrong. The work is to check the sender's domain and history, the link, the attachment and the context, and when it is a real supplier, to verify it, with your knowledge, through a channel you already trust: a phone number on file or a known contact, rather than replying to the email in question. Per Steven Masada of Microsoft's Digital Crimes Unit, quoted by Help Net Security after the EvilTokens takedown, organizations should "independently verify requests to change payment information, redirect funds, or approve unusual transactions through a trusted second channel." If nobody on your side or your provider's side is making that call, the investigation has not happened.
Sign 7: spam is in the inbox and real mail is in Junk
This one is simple to check and often overlooked. Open Junk. If it holds a customer's reply, a vendor's invoice and a job applicant's resume, probably nobody is maintaining the allow list, on the filter in front of your mail or on the mail platform itself. Now open the inbox. If it holds bulk marketing from senders your staff did not sign up with, probably nobody is maintaining the block list either. Block and allow lists are routine maintenance, the kind of thing a managed service should handle as a matter of course, and a license left alone leaves to whoever complains loudest. Newsletters your staff did sign up for belong in a folder of their own, and both Microsoft 365 and Gmail have built-in ways to sort them; if nobody has set that up, it is a small sign of a larger pattern.
Sign 8: there is no monthly summary
A managed service should tell you what it did. Once a month, in writing, is the standard we hold ourselves to: what was blocked, what was released, what policy changed and why, and anything you need to decide. If you have not received one, and nobody has shown you a dashboard that answers the same questions, the provider is either not doing the work or not telling you about it, and from the outside those look the same. Ask for last month's. The response time will tell you as much as the document.
Sign 9: nobody has looked at the tenant itself
Email security is not only the filter. The EvilTokens kit we wrote about stole sign-in tokens and then, per Microsoft, used them "for email exfiltration and persistence, often through the creation of malicious inbox rules that conceal communications." A rule that quietly forwards or hides the accountant's replies lives in your Microsoft 365 or Google Workspace tenant, not in the mail stream. A filter that only scans messages does not see it; account takeover protection, where licensed and enabled, may flag it, but someone still has to act on the alert. Ask whether anyone has reviewed your tenant for external forwarding rules, MFA coverage, third-party app permissions and the sign-in methods you do not use. If the answer is no, that review has to happen somewhere. It is why our customers get a written SaaS security posture report within their first 90 days at no charge, and why it is listed in what we include.
Sign 10: the invoice says "email security" and little else
Pull up the last bill. If it names a product tier, a user count and a service description, you can compare it to anything. If it says "email security, 25 users," the invoice has not defined what you are paying for; check whether the agreement behind it does. Our last post, Managed Email Security, item by item, lists what we include and what is optional, so you have a reference to hold the invoice against. The four questions at the end of that post settle most comparisons: which protection level, which mode, who works the quarantine each day, and what is included at no charge.
What to do with the results
Count the signs. One or two usually means a decent setup that needs a conversation with the provider; ask for the quarantine report, the tier name and the mode, and see what comes back. Four or more usually means a license was connected and left alone, and the gap between what the staff believe is protecting them and what actually is may be large.
Either way, there is a way to find out. Our free two-week email security assessment connects Check Point Email Security to your Microsoft 365 or Google Workspace by API, with no MX change, in Monitor only mode. During the assessment we quarantine nothing; your current filter and your current provider keep doing whatever they are doing, and you see what reached your inboxes anyway. Each business day we review what was flagged against what was delivered. At the end you get a written report and a walkthrough with your own examples, and you keep the report whether or not you sign. If you do not, we disconnect the platform and walk your admin through removing the app. If your current provider is doing the job, the report will say so, and the two weeks cost you a short session with your admin to connect, and another to disconnect if you decide not to sign.
The year-end offer
Managed Email Security is $8 per user per month, license and managed service together, no setup or onboarding fee. Through December 31, 2026, new customers who sign a 12-month agreement get 20% off, which is $6.40 per user per month; registered 501(c)(3) nonprofits get 30% instead, $5.60. New customers only, no onboarding fee. If you have a written, current quote from another provider for the same protection level and user count, like term and like scope, license only or with service, we match it or beat it. The discount is described in the year-end offer post, the price promise in our last post, and the service on our services page.
We work with small and medium businesses and nonprofits nationwide, including Washington DC, Northern Virginia, and Maryland. To start the free assessment, book a free 15-minute call.
Sources: Gartner press release on its 2026 CISO social engineering survey (Sept 22, 2026); Microsoft Security blog, "Unmasking EvilTokens" (Sept 22, 2026), and Help Net Security's report on the disruption; Huntress, "DarkMe Email Campaign Broadens Targeting For APT RAT" (Sept 22, 2026); Check Point Email Security administration guide (Anti-Phishing engine, Email Protection modes, Threat Detection Policy, Licensing the Email Security Product); cAIberOps service terms as published on caiberops.com.
