What you are evaluating
The scored scope is Microsoft 365 with read/write remediation. Cisco Secure Email Gateway and Cloud Gateway are separate products. Remediation applies to Exchange Online mailboxes, not on-premises mailboxes in a hybrid environment.
A useful evaluation context
Consider for a team evaluating a cloud-mail detection and response layer, especially where Cisco email products already participate in the mail path.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Policies configure analyzed mail directions and actions for threat, spam and graymail verdicts.
- Operators can reclassify a message and move it to junk, trash or a hidden quarantine folder.
- Documentation identifies allowlist interactions and irreversible deletion or purge limits.
Where it fits in the work
- Choose Microsoft 365 as the source and review the read versus read/write permissions.
- Enable a scoped remediation policy and confirm which domains it applies to.
- Inspect a test message, apply a reversible move and verify restoration before using delete.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
A benign training message is moved to quarantine and then restored before its retention limit.
Evidence to look for
Capture the actor, verdict and action result. Explain why a later purge or permanent-delete operation would change recovery options.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Are the target mailboxes in Exchange Online or still on-premises?
- Does an upstream gateway preserve the original sender information?
- Which delete or quarantine purge actions cannot be reversed by this product?