SECURITY ATLAS / EVALUATION BRIEF
Check Point Email Security
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/checkpoint-email-security/

THE ATLAS TAKE
Check Point Email Security offers a useful proposition for buyers wanting cloud-mail integration with a documented pre-delivery protection path. That combination deserves more care than the shorthand API-based suggests. The administrator guide describes interception, analysis and policy-driven delivery, with post-delivery actions also available. Atlas would focus the trial on proving that sequence for the intended Microsoft 365 configuration and making Mail Explorer useful to responders. Broader SaaS or messaging coverage should earn its place through separate requirements and entitlements, rather than being inherited from the platform name.

SCOPE
The scored configuration is Microsoft 365 email with enforcement and Mail Explorer, using the documented Email Security service. Messaging apps, file storage, DMARC management and other add-ons are not assumed to be in the email entitlement.

WORTH A LOOK WHEN
Microsoft 365 organizations evaluating integrated pre-delivery inspection and an analyst investigation workflow.

THINK TWICE WHEN
The selected subscription and tenant design cannot demonstrate the actual enforcement route.

IMPLEMENTATION
1. Draw the selected path
Include inbound, internal and outbound messages, tenant rules and any route that can bypass protection.

2. Stage the enforcement mode
Start with named test users and compare trace evidence before enabling broader blocking behavior.

3. Exercise analyst authority
Assign investigation and release permissions separately and test an erroneous quarantine through its complete reversal.

OPERATING REALITY
Mail and security teams must jointly own enforcement modes, exclusions and release decisions. Moving from visibility into protection changes the operational consequences of a verdict. The useful day-two measure is whether an analyst can reconstruct the decision, safely release a legitimate message and verify the final mailbox state.

COMMERCIAL CONSIDERATIONS
Request the exact Email Security subscription and any adjacent collaboration or data-protection modules separately. Include implementation work for tenant configuration and message-response operations.
- Protected users and selected service package
- Additional SaaS or collaboration coverage
- Tenant onboarding and ongoing release handling

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Send a safe synthetic policy trigger
Acceptance evidence: Capture pre-delivery trace evidence and the final message location.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Inspect a related-message investigation
Acceptance evidence: Retain Mail Explorer findings and the exact remediation scope.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Release a deliberately misclassified message
Acceptance evidence: Verify approval, audit and successful user receipt.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which permissions and connectors implement the chosen mode?
- Can the administrator explain why a message was quarantined?
- Which collaboration and account-protection modules are separately licensed?

EVIDENCE GAPS
- Atlas has not independently benchmarked detection, latency or false positives.
- Confirm tenant-specific enforcement behavior and module entitlement before production.

SOURCES
Email Security overview and administration scope (Documentation)
https://sc1.checkpoint.com/documents/Harmony_Email_and_Collaboration/Email_Security/Admin_Guide/Topics/introduction/introduction-to-Email-Security.html
Policy modes (Documentation)
https://sc1.checkpoint.com/documents/Sales_tools/DemoPoint/Harmony_Email_Collaboration/Topics/Step2-Create_Policy.htm?TocPath=Demo+Steps%7C_____2
Mail Explorer (Documentation)
https://sc1.checkpoint.com/documents/Sales_tools/DemoPoint/Harmony_Email_Collaboration/Topics/Step3-Mail-Explorer.htm
Admin release process (Documentation)
https://sc1.checkpoint.com/documents/Harmony_Email_and_Collaboration/Email_Security/Admin_Guide/Topics/admin-quarantine-release/admin-quarantine-release-process.html

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.