In short: ThreatDown Email Security protects cloud mailboxes from phishing, business email compromise and credential harvesting using adaptive AI, anomaly detection and crowdsourced threat intelligence, then removes threats automatically. It connects to your cloud email provider by API, with no MX record changes or agents, and is managed in the ThreatDown console. Through Forever Systems it is licensed per mailbox, monthly.
What ThreatDown Email Security is
Phishing and business email compromise remain among the most common ways into an organisation. ThreatDown Email Security adds a mailbox protection layer to the ThreatDown platform, so the same team and console that look after your endpoints also look after your inboxes.
Rather than sitting in front of your mail system as a gateway, it connects to your cloud email provider through a native API integration, with no MX record changes and no agents to install. Detection combines machine learning, behavioural and anomaly analysis and crowdsourced threat intelligence, so it can spot social engineering that carries no malicious link or attachment, and automatic remediation removes threats from mailboxes after delivery. ThreatDown states that the technology behind it comes from Ironscales, which we also supply directly.
What is included
| Capability | What it does |
|---|---|
| Adaptive AI detection | Machine learning, natural language analysis and anomaly detection to identify phishing and social engineering |
| Crowdsourced threat intelligence | Detections informed by threats reported by a large community of security teams |
| Automatic remediation | Detection, classification and removal of malicious messages from mailboxes |
| Threat coverage | Phishing, business email compromise, credential harvesting and other email-borne attacks |
| API connection | Connects to your cloud email provider without rerouting mail flow or changing MX records |
| Shared console | Managed alongside endpoint security in the ThreatDown console |
Because it works inside the mailbox, it complements the filtering built into your mail platform rather than replacing it. Pair it with phishing awareness training to cover the human side.
How it is licensed
| Item | How it works |
|---|---|
| Unit | Each protected mailbox (user) |
| Term | Monthly, billed on usage from our OneView console |
| Availability | An add-on to any ThreatDown bundle or module; it is not included in ThreatDown's direct bundles |
| Changes | Mailboxes are added and removed as staff join and leave; your invoice follows |
Prices depend on the number of mailboxes, so ask us for a quote. For background on user and mailbox counting, see per-user vs per-device licensing.
Requirements and deployment
ThreatDown Email Security connects to a cloud email provider through an API integration, so you need an administrator account able to grant that connection. We confirm that your mail platform, such as Microsoft 365, is supported and review the permissions it requests when we scope.
Our usual rollout:
- Connect the service to your mail platform and agree who receives alerts.
- Review the first detections with you and check for false positives on legitimate senders.
- Agree which threats are removed automatically and how users report suspicious mail.
- Route alerts to our team and agree how release requests are handled.
Keep your domain's DMARC, SPF and DKIM records in order too: they stop others spoofing your domain, which mailbox protection does not.
Who it suits
It suits organisations already running ThreatDown on their endpoints that want one vendor and one console for both, and those on cloud mail that want extra protection without the disruption of changing MX records. Small IT teams benefit from automatic remediation, which removes threats from every affected inbox rather than leaving users to delete them.
If you would rather filter mail before it arrives, compare a gateway such as Symantec Email Safeguard.cloud and other products in email security, or read about Microsoft 365 security on our Cloud Security site.
How we help
We connect the service, run the observation phase, tune detections and then monitor remediation for you, handling false positives and release requests. Email security sits on the same Forever Systems invoice as your other ThreatDown modules. Contact us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does ThreatDown Email Security need MX record changes?
No. ThreatDown states it connects with no MX record changes and no agents, so mail flow is not rerouted.
How is ThreatDown Email Security licensed?
Through Forever Systems it is licensed per protected mailbox and billed monthly on the mailboxes covered.
What technology is ThreatDown Email Security built on?
ThreatDown states that its Email Security product is powered by Ironscales technology, combined with ThreatDown's console so email and endpoint threats are managed in one place.
Is email security included in ThreatDown bundles?
No. ThreatDown lists Email Security as an add-on to all of its bundles; we can add it to any ThreatDown subscription.