We have written about what Managed Email Security includes and how to tell whether a provider is managing anything. This post is the calendar: what happens between the day you sign and the end of your third month, what changes for your staff, what does not, and what we need from you along the way. If you are deciding whether to switch, this is the part that rarely makes it onto a quote.
Day 0: the agreement and what it does not include
The price is $8 per user per month, license and managed service together. There is no setup fee, no onboarding fee, no multi-year contract, and no project plan with a billable discovery phase. Through December 31, 2026, new customers who sign a 12-month agreement get 20% off, which is $6.40 per user per month; registered 501(c)(3) nonprofits get 30% instead, $5.60. New customers only, no onboarding fee. Full terms are in the year-end offer post.
What we ask for before day 1 is short: the name of the person who can approve a connection in your Microsoft 365 or Google Workspace tenant, the name of the person who decides when a held message should be released if it is not obvious, and a phone number on file for the two or three suppliers whose invoices matter most. That last one is for us, not for the platform; it is how we can check a bank-details change that reaches us, without replying to the email that asked for it.
Day 1: one session, and scanning starts
Onboarding is two sessions. The first is a working call with whoever has admin rights to your tenant. On that call your admin approves the connection to Check Point Email Security, the platform we run, which Check Point describes as "an API-based inline protection service." The approval happens in your own tenant, on your screen, and we walk through what is being granted as it is granted. On Microsoft 365 the connection is one consent screen, granted by an admin with the Privileged Role Administrator role or higher, for the application Check Point names "Check Point Cloud Security Platform - Emails V2"; you see the permission list before you click Accept. Your MX records do not change. Mail keeps arriving the way it does today, and your Microsoft or Google filtering stays in place. Per Check Point, in inline mode Email Security "redirects the mail for scanning" and, if clean, "returns email to the mail flow," a step Check Point puts at 10 seconds to 5 minutes. No software is installed on laptops or phones.
Scanning starts the same day. Per Check Point, the platform first runs a short calibration it calls Learning Mode, "from a couple of minutes to 72 hours, depending on the number of protected mailboxes and the volume of their emails," while the anti-phishing engine learns your normal traffic; during that window, Check Point says, no email is flagged as phishing or spam, and the other engines "work as usual in the Learning Mode and flag the malware, DLP, Shadow IT, and anomalies" (DLP is in Check Point's Complete Protect package, not the one described here). Once calibration completes we move the policy to Prevent (Inline), which your admin approved on the first call; on Microsoft 365 that step creates Check Point's connectors and mail flow rules in your tenant. Prevent (Inline), per Check Point, means "the workflow scans the emails prior to delivery to the user." From then on, incoming mail is intercepted and sent "to Check Point's ThreatCloud for analysis before the email is delivered to the recipient," and a message the engines judge malicious is held before it reaches the inbox.
Your staff do not notice day 1, and that is the point. Same Outlook or Gmail, same folders, same phone. The two things they do get are a way to forward anything that looks wrong to us, and a person who answers when they ask whether a held message can be released. Support is 24/7; the routine review of what was flagged happens each business day.
Days 1 to 14: the tuning period
The first two weeks are our tuning period, not the platform's: Check Point's own calibration finishes within 72 hours, and after that the work is reviewing what was held and setting lists and policy for your business. Each business day we review what the platform flagged against what was delivered. Some of what it holds in the first week is legitimate: a scanner that emails PDFs from a shared mailbox, a payroll provider whose notices look like phishing because phishing copied them, a customer whose domain was registered last month. We release those, add the sender to the allow list where that is the right fix, and adjust the policy so the same message does not get held twice. We also build the block list from what your staff forward and what we see repeating.
The same period gives us the Shadow IT picture, which starts building from the first day. Check Point's unauthorized-applications detection reads the sign-up and notification emails that SaaS tools send to your users, so by the second session we can show you the cloud apps your staff appear to be using with their work email. We report it; you decide what to do about it.
What you should expect from us during the tuning period: a release answered by a person after looking at the sender and the attachment, a short note when we change a policy that affects how mail flows, and your approval before we enable a new protection or change anything in your Microsoft 365 or Google Workspace settings. If two weeks pass and you have heard from us about no held message and no suspicious sender, ask; a quiet fortnight should mean we had no question for you, not that nobody looked.
Day 14: the second session, and the policies you sign off on
About two weeks in, the second onboarding session. We walk through what the platform held, what we released and why, and what the engines were unsure about. Then we set the policies together: the confidence thresholds the anti-phishing and spam engines use before they hold a message, which file types attachment cleaning applies to and which users or groups it covers, whether your staff can restore an original attachment on their own or only after we approve it, how internal mail should be handled, and who on your side can ask for a release.
Internal mail deserves a sentence of its own. Per Check Point, internal emails are inspected in Detect and Remediate mode by default, which means after delivery; on Microsoft 365 the platform also supports inline protection for internal traffic, and we turn that on with your approval, since it relies on an additional Check Point mail flow rule and a connector setting in your tenant. Internal mail is where a compromised mailbox does its damage, so this is a decision we want you to make knowingly rather than one we make for you.
By the end of this session you know which protection level you have (Check Point's Advanced Protect on the Email Only package, which per Check Point's licensing guide "Includes phishing protection, account takeover protection, and protection against known and unknown malicious URLs (URL Emulation) as well as known and unknown malicious files (Sandbox and CDR)"), which mode it runs in, who works the quarantine each day, and what is included at no charge. Those are the four questions from our post on comparing quotes, and you should be able to answer them about your own service.
Day 30: the first monthly summary
At the end of the first month you get a written summary: what was blocked, what was released, what policy changed and why, and anything you need to decide. It is short, written for the owner, not a dashboard export. If you ran the free assessment first, we refer back to it in the first summary.
The summary is also where we tell you what we could not conclude. If a message was held and we could not confirm whether the sender was legitimate, you see it there with what we did. We do not count a quiet month as proof of anything; we tell you what the engines saw and what we did with it.
Days 30 to 90: the SaaS security posture report
Within your first 90 days you get a one-time written SaaS security posture report, at no charge. It is the complimentary tenant review from the year-end offer, written up as a report; where you approve a change from it, we make it with you. It covers the parts of your Microsoft 365 or Google Workspace tenant that the email filter does not touch but that an attacker who gets one password will: MFA coverage and conditional access (context-aware access on Google Workspace), admin and emergency access accounts, external forwarding rules, external sharing settings, mail platform allow lists, third-party app permissions, the device code sign-in flow, and SPF, DKIM and DMARC, with the exact records to publish.
The report is a document, not a project. Each item says what we found, what we recommend, and what changing it would affect. Changes to your tenant happen only with your approval, and some of them, such as tightening external sharing or turning off a sign-in method, are decisions for you and not for us. Adelia Risk, for example, publishes a one-time Microsoft 365 security audit at $999 (checked October 2026); for customers the posture report is part of the first 90 days.
What comes off your plate
From day 1, the email security work is ours, and support is 24/7. Nobody on your side watches a quarantine, weighs whether a held invoice should be released, maintains block and allow lists, reads Check Point's release notes, decides which new protection to turn on, or investigates the message your bookkeeper forwarded with "does this look right?" Your staff forward what looks wrong and ask for a release when they need one; a person answers. Your admin approves changes to the tenant when we ask; we do the rest. If you have no IT team, this is the email security function you did not have. If you have one, it is the part of their week they hand over.
What does not change
Your mail client. Your MX records. Microsoft's or Google's own filtering, which keeps running in front of us. Your staff's habits, except one: they forward what looks wrong instead of deleting it, and they ask before clicking a link they did not expect. We are not a penetration test or a vulnerability scan, and we do not sell either; we do not write your policies or certify compliance. The controls above support the email side of frameworks such as HIPAA, the FTC Safeguards Rule, NIST 800-171 and CMMC, not the whole framework, and we will not tell you otherwise.
When the service ends
If the service ends, we disconnect the platform and walk your admin through removing the app, its connectors and mail flow rules (on Google Workspace, the routing settings, groups and compliance rules the setup created). Your MX records did not change, so there is no mail routing to put back. You keep the monthly summaries and the posture report.
Where to start
If you would rather see the engines work on your own mail before signing anything, the free two-week email security assessment is the same connection in Monitor only mode. During the assessment we quarantine nothing; your current filter keeps working and you see what it let through. At the end you get a written report and a walkthrough with your own examples, and you keep the report whether or not you sign.
We work with small and medium businesses and nonprofits nationwide, including Washington DC, Northern Virginia, and Maryland. To start the assessment or ask about the first 90 days, book a free 15-minute call. The service is described on our services page.
Sources: Check Point Email Security administration guide (Introduction, Onboarding next steps and Learning Mode, Activating Office 365 Mail, Email Protection modes, Threat Detection Policy, Threat Detection Policy for Internal Emails, Anti-Phishing, Attachment Cleaning, Shadow IT, Licensing the Email Security Product); cAIberOps service terms as published on caiberops.com; Adelia Risk published Microsoft 365 security audit pricing, checked October 2026.
