In short: Cisco Secure Email Gateway, formerly the IronPort Email Security Appliance (ESA), is Cisco's secure email gateway. It sits in front of your mail system and applies reputation filtering, anti-spam, antivirus, outbreak filters, malware defence and sandboxing, DLP, encryption and DMARC checks. It runs as Secure Email Cloud Gateway, on-premises (hardware or virtual) or hybrid.
What is Cisco Secure Email Gateway?
Cisco bought IronPort in 2007, and the IronPort Email Security Appliance became Cisco's email gateway. After several names, including ESA and Cisco Email Security, it is now Cisco Secure Email Gateway, and the Cisco-hosted version is Secure Email Cloud Gateway (formerly Cloud Email Security). It still runs AsyncOS, which Cisco continues to develop: AsyncOS 16.5 was released in September 2026.
A gateway is a mail transfer agent that sits in the path of your mail. Your MX records point to it, it inspects each message, and only clean mail goes on to Microsoft 365, Exchange or whatever mail system you use. Outbound mail can be routed back through it for DLP, encryption and reputation protection.
How it filters mail
Each message passes through a pipeline of checks:
- Reputation filtering at connection time, using Talos sender reputation to refuse or throttle mail from known bad sources before the message is even accepted
- Sender authentication: SPF, DKIM and DMARC verification, with forged email detection for messages that impersonate your executives
- Anti-spam with sender domain reputation and URL filtering
- Antivirus, with an optional McAfee engine alongside Cisco's own
- Malware defence and analytics: file reputation and sandboxing through Secure Malware Analytics, with retrospective alerts if a delivered file is later found to be malicious
- Outbreak filters: hold or rewrite suspicious messages during a new campaign, and send clicks on rewritten URLs through Cisco's web proxy for checking at the time of click
- Graymail detection and safe unsubscribe: sort marketing, bulk and social mail, and unsubscribe users safely without visiting a possibly malicious link
- Content filters and DLP: policies on outbound mail for sensitive data such as payment card or personal data, with encryption through the Secure Email Encryption Service
Which of these you have depends on the bundle; see the Essentials and Advantage table on our Cisco Secure Email page.
Cloud, on-premises or hybrid
| Deployment | How it works | Good for |
|---|---|---|
| Secure Email Cloud Gateway | Cisco hosts dedicated gateway instances for you in resilient Cisco data centres; management is included in the licence | Most organisations, especially those on Microsoft 365 |
| On-premises | Gateways on Cisco hardware or as virtual machines in your own data centre | Organisations that need mail to stay on their own infrastructure, or have complex internal routing |
| Hybrid | Cloud gateways for inbound filtering, with on-premises gateways for outbound mail, internal routing or specific policies | Large or regulated estates moving to the cloud in stages |
On-premises and hybrid deployments need Cisco Secure Email and Web Manager (formerly the Security Management Appliance) for central reporting, message tracking, spam quarantine and configuration across gateways. The same manager also handles Cisco Secure Web Appliance. With cloud gateways, management is part of the licence.
Changing MX records and cutting over
Moving to a gateway, or between gateways, is mostly about planning mail flow:
- Document every domain, inbound route, outbound sender (including applications and printers that send mail) and existing SPF, DKIM and DMARC records
- Build the gateway policies, listener settings and mail routes, and import allow and block lists from the old system
- Lower the TTL on your MX records, then point a test domain or a small group at the new gateway
- Lock down your mail system so it accepts inbound mail only from the gateway, so attackers cannot bypass it
- Update SPF and add DKIM signing for outbound mail through the gateway, then move the remaining domains
- Review quarantines and false positives for the first weeks, and move DMARC towards enforcement
We run cut-overs like this regularly, including from other vendors' gateways, and keep the old system on standby until the new one has proved itself.
Pairing the gateway with Secure Email Threat Defense
A gateway judges each message as it arrives. It cannot easily see an internal account that has been taken over, or a carefully written payment request that contains no link or attachment. That is where Secure Email Threat Defense helps: it models relationships and conversations, inspects internal mail and can pull messages from mailboxes after delivery.
Cisco sells Threat Defense as an add-on for gateway customers, and the gateway (on-premises or cloud) can pass mail to it through a connector whatever your mailbox platform, so you get gateway policy and volume filtering with conversation-aware detection on top. Many organisations also add Cisco Domain Protection for DMARC, and connect both to Cisco XDR for investigation.
Who it suits and how we help
Secure Email Gateway suits organisations that need firm control over mail flow: outbound DLP and encryption, many domains, on-premises or mixed mail systems, or regulatory requirements about where mail is processed. Microsoft 365 organisations with simpler needs may get more value from Threat Defense alone; we will tell you which.
We design, deploy and migrate gateways, tune policies and quarantines, and support them afterwards, including AsyncOS upgrades. The gateway is licensed per user in Essentials or Advantage bundles with optional add-ons; ask us for a quote.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cisco IronPort still available?
The IronPort name is retired, but the product lives on as Cisco Secure Email Gateway, with the cloud-hosted version called Secure Email Cloud Gateway. Cisco continues to release AsyncOS updates for it.
What is the difference between Cisco ESA and Secure Email Gateway?
They are the same product. Cisco renamed the Email Security Appliance (ESA) to Cisco Secure Email Gateway. The Cloud Email Security service became Secure Email Cloud Gateway.
Do I need Secure Email and Web Manager?
Only for on-premises and hybrid gateways, where it provides central reporting, tracking, quarantine and configuration. Cloud gateway licences include management.
Can Cisco Secure Email Gateway protect Microsoft 365?
Yes. You point your MX records at the gateway and restrict Exchange Online to accept mail only from it. Many organisations add Secure Email Threat Defense for post-delivery remediation and BEC detection.
Does Cisco Secure Email Gateway support DMARC?
Yes. It verifies SPF, DKIM and DMARC on inbound mail and can sign outbound mail with DKIM. Cisco Domain Protection, an add-on, helps you publish and enforce DMARC for your own domains.