Most of what we publish is about an attack somebody else found. This post is about the service itself: what Managed Email Security from cAIberOps includes, item by item, what is optional, what we do on your behalf each business day, and what it costs. If you are comparing quotes, this is the page to hold next to the other one.
The platform, and how it connects
Managed Email Security runs on Check Point Email Security (formerly Harmony Email & Collaboration), which Check Point describes as "an API-based inline protection service." It connects to Microsoft 365 or Google Workspace through the vendor's API; your admin approves the connection in your own tenant, on a call with us, and your MX records do not change, during the free assessment or after you sign. That matters for two reasons. There is no migration, and your existing Microsoft or Google filtering keeps running. Per Check Point, "When an email is sent, Email Security intercepts and sends the email to Check Point's ThreatCloud for analysis before the email is delivered to the recipient." Because the connection is an API integration rather than an MX change, mail still arrives through Microsoft's or Google's own filtering first. Per Check Point, in inline mode Email Security then "redirects the mail for scanning" and, if clean, "returns email to the mail flow." We are the second layer, not a replacement for the first.
We run the platform in Prevent (Inline) mode, which per Check Point "scans the emails prior to delivery to the user." A message the engines judge malicious is held before it reaches the inbox, not pulled back after someone has already opened it. That is what we mean when we say prevention first.
What is included, item by item
Our standard service is Check Point's Advanced Protect level on the Email Only package, which covers Microsoft 365 mail and Gmail, incoming and internal. Per Check Point's licensing guide, Advanced Protect "Includes phishing protection, account takeover protection, and protection against known and unknown malicious URLs (URL Emulation) as well as known and unknown malicious files (Sandbox and CDR)." In plain terms, here is what each of those means for your inbox.
Anti-phishing. Per Check Point's documentation, the engine "analyzes various components of an email, such as attachments, links, sender reputation, domain analysis, OCR, URLs behind QR code, and many more." That is the layer aimed at the invoice from a lookalike domain, the "your password expires today" notice, the QR code that hides a link, and the message that impersonates your CEO or a vendor you pay.
Account takeover protection. Per Check Point's licensing guide, Advanced Protect includes "Account takeover prevention (Anomalies)": the platform flags unusual logins and mailbox changes, and we investigate them.
Link protection at delivery and at the click. Per Check Point, Click-Time Protection "replaces links in the email's body and attachments," so that when someone clicks, "the website behind the link is inspected to ensure it is not a phishing website." At the click, Check Point runs two engines: URL Reputation, and URL Emulation, which per Check Point "Emulates the website to detect zero-day phishing websites." A link that was clean at 9 a.m. and turned into a credential page at 2 p.m. is inspected again when someone clicks it at 2 p.m.
Attachment sandboxing. Per Check Point, the Anti-Malware engine "uses Check Point's ThreatCloud to detect files containing known malware (Anti-Virus) and Check Point's advanced sandbox (Threat Emulation) to detect the evasive zero-day malware." The file is detonated in Check Point's sandbox before your accountant opens it (per Check Point, files under 50 MB).
Attachment cleaning. Per Check Point, Attachment Cleaning (Threat Extraction) "delivers a secure version of the attachment to the end user, removing hyperlinks behind text, macros, and other active content that may contain malware." The document arrives usable; the active content that most often carries a payload is stripped out.
Internal mail. The same engines scan mail between your own users. Per Check Point, internal emails are inspected in Detect and Remediate mode by default, which means after delivery; on Microsoft 365 the platform also supports inline protection for internal traffic, and we turn that on with your approval, since it adds a mail flow rule in your tenant. Internal mail is where a compromised mailbox does its damage: a hijacked account sending "updated bank details" to the person who pays vendors.
Shadow IT visibility. Check Point's unauthorized-applications detection reads the sign-up and notification emails that SaaS tools send to your users, so you get a list of the cloud apps your staff appear to be using with their work email. We report it; you decide.
Spam and bulk mail handling. Spam goes to Junk, block and allow lists are maintained, and the false positives your staff report get tuned out.
What is optional
Two things are not in the standard service, and we say so up front because prospects often assume they are.
Data loss prevention. Per Check Point, the DLP engine "scans emails, attachments, shared files, and text messages, even extracting text from images using OCR" for confidential, financial and personally identifiable data, with policy workflows that can quarantine a message or, where Check Point Email Encryption is licensed, route it through encryption. Per Check Point's licensing guide, it is included in the Complete Protect tier. If your business handles patient records, financial account data, or client files under an NDA, ask for it and we quote the Complete Protect tier; if you do not need it, you are not paying for it.
Collaboration tool coverage. The Email and Collaboration package extends the same scanning to OneDrive, SharePoint and similar file-sharing apps. Optional for the same reason.
Other add-ons on our price list: Security Awareness Training, with phishing simulation emails that per Check Point reflect recent attacks, plus interactive training modules ($2 per user per month), and Dark Web Monitoring for leaked credentials ($2 per user per month). Add-ons attach to the core service; we do not sell them alone.
What we actually do, because a license alone is not a service
This is the part a price comparison misses. Some providers sell the license, connect it, and forward the alerts. We are not an alerting MSSP; we do the work behind the alerts. Here is the week.
Each business day we review what the platform flagged against what was delivered. When something looks wrong but the engines were not certain, we do the due diligence: we look at the sender's domain and history, the message, the link, the attachment, and the context. When it is a supplier or a customer of yours, we reach out, with your knowledge, and verify through a channel we already trust, a phone number on file or a known contact, rather than replying to the email in question. When a message was held and it is legitimate, we release it and tune the policy to reduce the chance of a repeat. When one got through, we investigate how, remove it from other mailboxes if it landed in more than one, and tell you what changed.
We run the quarantine. Your staff do not learn a security console. They forward what looks suspicious, ask for a release when they need one, and get an answer from a person. Support is 24/7; the routine review of what was flagged happens each business day.
We manage the block and allow lists, handle restore requests, route spam to Junk, and enable new platform protections as Check Point releases them, with your approval whenever a change touches your tenant.
You get a monthly summary of what was blocked, what was released, and what we changed.
Onboarding is two sessions: one where your admin authorizes the connection and scanning starts, and one about two weeks later where we walk through what the platform flagged and set the policies together.
Within your first 90 days, you get a written SaaS security posture report at no charge: MFA coverage and conditional access (context-aware access on Google Workspace), admin and emergency access accounts, external forwarding rules, external sharing settings, mail platform allow lists, third-party app permissions, device code flow, and SPF, DKIM and DMARC, with the exact records to publish. Changes to your tenant happen only with your approval. Similar reviews are sold standalone elsewhere from about $1,000 to $3,500 and up, based on published prices we checked in September 2026.
What we do not do
Managed Email Security is not a penetration test or a vulnerability scan, and we do not sell either. It is not compliance certification, and we do not write your policies. The controls above support the email side of frameworks such as HIPAA, the FTC Safeguards Rule, NIST 800-171 and CMMC; they do not make a business compliant on their own, and we will not tell you they do.
What it costs, and the price promise
Managed Email Security is $8 per user per month. That is the license and the managed service together. No setup fee, no onboarding fee, no multi-year contract.
If you have a written, current quote from another provider for email security at the same protection level, meaning anti-phishing, account takeover protection, click-time link protection, sandboxing and attachment cleaning, for the same number of users, send it to us. The vendor does not have to be Check Point; Proofpoint, Mimecast, Microsoft Defender for Office 365 or another platform with the same capabilities counts. If it is a managed offer, we compare the same scope of service, and we compare like term with like term. Apples to apples, we will match that price or beat it. Guaranteed, on those terms. That applies whether the quote is for the license alone or for license plus service. We would rather win on the work than lose on a number, so the number will not be the reason.
Through December 31, 2026, new customers who sign a 12-month agreement get 20% off, which is $6.40 per user per month; registered 501(c)(3) nonprofits get 30% instead, $5.60. New customers only, no onboarding fee. Full terms are in the year-end offer post, and the service is described on our services page.
How to compare two quotes fairly
Four questions settle most comparisons. Which protection level is quoted: anti-phishing only, or anti-phishing plus URL emulation, sandboxing and attachment cleaning? Which mode: does the filter hold mail before delivery, or scan it after it lands? Who works the quarantine each day, and what happens when your bookkeeper asks whether an invoice is real? And what is included at no charge: the tenant review, the monthly summary, the onboarding sessions? Put both quotes against those four and the comparison is honest. Then send us the other one.
Start with the free two-week assessment
The free two-week email security assessment connects the platform in Monitor only mode, which per Check Point "provides visibility into the cloud-hosted email." During the assessment we quarantine nothing; your current filter keeps working and you see what it let through. Each business day we review what was flagged against what was delivered. At the end you get a written report and a walkthrough with your own examples, and you keep the report whether or not you sign. If you do not, we disconnect the platform and walk your admin through removing the app.
We work with small and medium businesses and nonprofits nationwide, including Washington DC, Northern Virginia, and Maryland. To start the free assessment, book a free 15-minute call.
Sources: Check Point Email Security administration guide (Introduction, Email Protection modes, Threat Detection Policy, Threat Detection Policy for Internal Emails, Anti-Phishing engine, Click-Time Protection, Anti-Malware, Attachment Cleaning, Data Loss Prevention, Email Encryption, Shadow IT, Security Awareness Training, Licensing the Email Security Product); cAIberOps service terms as published on caiberops.com; published standalone assessment pricing from Adelia Risk and TenantShield, checked September 2026.
