In short: Cisco Secure Email Threat Defense, formerly Cloud Mailbox Defense, is Cisco's cloud-native email security service. Essentials connects to Microsoft 365 by journaling and Microsoft APIs with no change to mail flow, detecting phishing, BEC, account takeover and scams and removing threats after delivery. Advantage adds an inline pre-delivery gateway mode and supports Google Workspace and Exchange on-premises.
What is Secure Email Threat Defense?
Secure Email Threat Defense (ETD) began as Cisco Cloud Mailbox Defense, a service that protects Microsoft 365 from inside the tenant rather than in front of it. It gives you visibility of inbound, outbound and internal mail, applies Cisco Talos intelligence and Cisco's own detection models, and can move or delete a message in users' mailboxes when it turns out to be malicious.
Because Essentials does not sit in the mail flow, it is quick to deploy and does not risk mail delivery. It is designed to sit alongside Microsoft's built-in protection and catch what that misses, particularly targeted attacks that contain no malware at all.
What it detects
- Business email compromise (BEC), including invoice and payment fraud, and suspicious replies inserted into existing conversations
- Brand and user impersonation, including people you flag as high-impact (for example finance and the leadership team)
- Phishing, including QR code phishing, and scams that rely on social engineering rather than malware
- Account takeover, where a compromised internal mailbox starts sending malicious mail
- Ransomware and malicious attachments and URLs, with file reputation and sandboxing from Cisco Secure Endpoint and Secure Malware Analytics
- Spam and graymail, with separate verdicts so they can be handled differently from threats
Cisco combines identity and relationship modelling (who normally writes to whom, and how) with real-time behavioural analytics, sender authentication checks and machine learning, and can issue a retrospective verdict on a message that was not identified as malicious at first. Each message gets a verdict such as BEC, scam, phishing, malicious, spam, graymail or neutral.
Essentials vs Advantage
Cisco's current data sheet describes two editions:
| Threat Defense Essentials | Threat Defense Advantage | |
|---|---|---|
| How it connects | Journaling plus Microsoft APIs; no inline change | Inline, cloud-delivered gateway with pre-delivery inspection; in Microsoft 365 it can also use journaling for internal mail |
| Mail platforms | Microsoft 365 (or any platform behind a Cisco Secure Email Gateway, through a connector) | Microsoft 365, Google Workspace, Exchange on-premises and other mail servers |
| Message directions | Inbound and internal, with outbound visibility only | Inbound, internal and outbound |
| Blocking | Post-delivery remediation | Pre-delivery blocking and policy enforcement, plus post-delivery remediation |
| Data loss prevention | Not included | Integrates with Secure Access DLP (licensed separately) |
| Best fit | Adding to Microsoft 365's own protection | Replacing or consolidating a gateway, or mixed mail platforms |
Existing Secure Email Gateway customers can add Threat Defense Essentials, and the gateway can pass mail to it through a connector. Threat Defense Essentials is also part of the Breach Protection Suite and the User Protection Suite.
Visibility, search and remediation
For the people who handle reported phish, the console matters as much as the detection:
- Conversation view and message trajectory show a message in the context of the thread and what happened to it from receipt to action
- Search by sender, recipient, subject, IP address, URL, attachment name or Microsoft message ID, so you can find every copy of a campaign quickly
- Automatic remediation by policy: move to junk, trash or quarantine, or delete, with exceptions where you need them
- Manual remediation of any message you find, in real time, when ETD has read-write access to Microsoft 365
- Reports and exports on trends, impact and blocked connections
- Integrations with Cisco XDR and other SOC tools through REST APIs
Deploying Threat Defense with Microsoft 365
- Set up the ETD account and authorise it against your Microsoft 365 tenant, choosing read-only or read-write access to mailboxes
- Add the journal rule in Microsoft 365 so a copy of mail reaches ETD; no MX change is needed
- Start with remediation switched off, review verdicts, and add your high-impact personnel list and any allowed senders
- Turn on automatic remediation for malicious and phishing verdicts, then decide how to treat spam and graymail
- Connect ETD to Cisco XDR or your SIEM, and set up how users report suspicious mail
We do this as a short project and stay involved for the first weeks of tuning. If you want an independent view of your tenant first, see our Microsoft 365 security assessment.
Who it suits and how we help
Threat Defense Essentials suits Microsoft 365 organisations that want better protection against targeted phishing and BEC without the change and risk of putting a gateway in front of their mail. Advantage suits organisations that want gateway-style pre-delivery blocking from a cloud-native service, or that run Google Workspace or Exchange on-premises.
We also supply alternatives such as Check Point Harmony Email and Collaboration, and will give you a straight comparison. ETD is a per-user subscription on 1, 3 or 5 year terms; ask us for a quote. Cisco offers a free trial, and we can set it up on your tenant; contact us to arrange it.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cisco Cloud Mailbox Defense the same as Secure Email Threat Defense?
Yes. Cisco Cloud Mailbox Defense was renamed Cisco Secure Email Threat Defense. It is now sold in Essentials and Advantage editions, with an inline gateway mode in Advantage.
Does Secure Email Threat Defense need an MX record change?
Not for Essentials, which receives mail by Microsoft 365 journaling and uses Microsoft APIs to act on mailboxes. The Advantage gateway mode sits in the mail flow, so mail is routed through it.
Does Secure Email Threat Defense replace Microsoft Defender for Office 365?
Essentials is designed to supplement Microsoft 365's built-in protection, catching targeted phishing and BEC that gets through. Whether you keep Defender for Office 365 depends on your licences and needs; we can help you decide.
Does Cisco Email Threat Defense support Google Workspace?
Yes, with Threat Defense Advantage, which also supports Exchange on-premises and other mail servers. Threat Defense Essentials is built for Microsoft 365, although it can also inspect mail passed to it from a Cisco Secure Email Gateway, whatever the mailbox platform.
Can Secure Email Threat Defense remove emails after delivery?
Yes. With read-write access to Microsoft 365 it can move or delete messages in users' mailboxes automatically by policy, or manually when an administrator finds a threat.