Managed Email Security

Email is still the most common way into an organization. We configure, monitor and respond to email threats for you, so phishing and impersonation attempts are dealt with by people who understand how they turn into account takeover.

What is included

  • Configuration review. We check that your anti-phishing, anti-spoofing and attachment and link protections are turned on and set sensibly, and review SPF, DKIM and DMARC for your domains.
  • Monitoring. Detections are reviewed by our analysts instead of piling up in a console.
  • User-reported messages. Suspicious messages your staff report are looked at and answered, so people learn that reporting is worthwhile.
  • Remediation. Malicious messages are removed from affected mailboxes, and senders, domains and links are blocked where appropriate.
  • Impersonation watch. We look for messages that pose as executives, vendors or your own domain, which is how payment fraud often begins.

How it works

  1. Assess. Review current mail protections, domain settings and how mail flows.
  2. Configure. Close the gaps found and agree how reports and alerts reach us.
  3. Operate. Monitor, triage and remediate day to day.
  4. Report. Summarize what was caught, what was removed and what should change.

What you receive

  • Periodic reporting on threats blocked, messages removed and trends
  • Recommendations for settings, policies and user awareness
  • Fast escalation when a message looks like part of a compromise
  • A direct path to BEC and Microsoft 365 investigation if an account has been taken over

What we need from you

Administrator access to review your mail protection settings and domain records, a contact for decisions about blocking senders or removing messages, and a way for staff to report suspicious mail. We agree up front which actions we take on our own and which we confirm with you first.

Why it matters

A single convincing message can lead to a stolen mailbox, a fraudulent payment or a ransomware foothold. Technology catches a lot, but a human review of what slips through, and of what staff report, closes much of the remaining gap.

Works with identity monitoring

Stopping the message is half the job. If someone does click, the next signs appear in sign-in activity and mailbox rules. Pairing email security with M365 and identity monitoring lets us catch both. Email protection is also one of the nine layers of CMDR.

Who it fits

Organizations that depend on Microsoft 365 or similar hosted email and want someone accountable for what reaches their staff, including firms that have already seen a fraudulent invoice or a stolen mailbox.

Get in touch

Tell us about your environment and what you want covered, and we will explain how this service would fit. Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day.

Coverage depends on the services selected and your environment.