In short: Hornetsecurity Advanced Threat Protection adds protection against targeted email attacks to Spam and Malware Protection. It runs attachments in a sandbox, rewrites links so they are checked at click time, scans QR codes, decrypts and scans protected documents and uses AI forensics to spot CEO fraud and spoofing. It is licensed per user and included from Plan 2.
What Advanced Threat Protection is
Spam filters catch bulk and known threats. Targeted attacks are different: a convincing email from a "supplier" with new bank details, a document carrying malware no scanner has seen yet, or a QR code that leads to a credential-harvesting page. Advanced Threat Protection (ATP) is Hornetsecurity's layer for these.
ATP works with Spam and Malware Protection rather than replacing it, and is included in 365 Total Protection Plan 2 and above. Real-time alerts notify your IT security team when an acute attack against your organisation is under way.
What it includes
| Feature | What it does |
|---|---|
| Sandbox Engine | Opens attachments in an isolated environment to see what they do before delivery |
| Secure Links | Replaces links with rewritten versions that route through Hornetsecurity's secure web gateway, using machine learning and deep learning against phishing |
| Quishing detection | Finds QR codes in the email body or images (GIF, JPEG, PNG, BMP) and checks where they lead |
| Malicious document decryption | Decrypts encrypted attachments using text modules from the email, then scans the contents for malware |
| Targeted fraud forensics | Spy-out detection, feign facts identification, intention recognition and fraud attempt analysis of metadata and content |
| Identity spoofing recognition | Detects and blocks forged sender identities used in business email compromise |
| Targeted attack detection | Flags attacks on people who are particularly at risk, such as finance staff and directors |
| Real-time alerts | Notifies administrators of acute attacks as they happen |
How it is licensed
Advanced Threat Protection is licensed per user and builds on Spam and Malware Protection. Because Plan 2 of 365 Total Protection bundles ATP with Email Archiving and the Email Continuity Service, most Microsoft 365 customers find the plan is the simpler purchase.
| Option | Includes ATP |
|---|---|
| Spam and Malware Protection with ATP added | Yes |
| 365 Total Protection Plan 1 | No |
| 365 Total Protection Plans 2, 3 and 4 | Yes |
Deployment
ATP is managed in the same Hornetsecurity control panel as the filtering service. Sandboxing, document decryption and link rewriting happen as mail passes through Hornetsecurity's gateway, so MX mode or Hybrid mode is needed for them. Hybrid mode, which Hornetsecurity recommends, adds post-delivery scanning in Microsoft 365 on top. We set the alert recipients, agree who handles real-time attack alerts and test the Secure Links experience with a few users before switching everyone over.
Who it suits and how we help
ATP suits organisations that handle payments, personal data or confidential documents, where one successful phishing email is costly. It also helps demonstrate the malware protection control in Cyber Essentials. Pair it with user training so staff recognise what gets through; see phishing awareness training.
Ask us for a quote for ATP alongside your existing filtering and for Plan 2, and we will show you what each option includes.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does Hornetsecurity Advanced Threat Protection add to spam filtering?
Sandboxing of attachments, Secure Links URL rewriting, QR code analysis, decryption and scanning of protected documents, and AI-based detection of CEO fraud, spoofing and targeted attacks.
Which 365 Total Protection plans include Advanced Threat Protection?
Plans 2, 3 and 4. Plan 1 includes Spam and Malware Protection, encryption and signatures, but not ATP.
Does Advanced Threat Protection stop QR code phishing?
It detects QR codes embedded in emails or images and checks the destination for malicious content before the user scans it.
Does Advanced Threat Protection protect against ransomware?
It addresses one of the main routes ransomware takes into an organisation: email. Attachments are run in the sandbox, encrypted documents are decrypted and scanned before delivery, and links are rewritten through Hornetsecurity's secure web gateway. It does not replace endpoint protection or backup.