Advanced AI Detection for Secured (Encrypted) Emails

Check Point Email Security now introduces AI-powered phishing detection for secured (encrypted) emails.

Secured emails, such as those protected with Microsoft Purview Message Encryption, cannot be fully inspected by email security solutions because their content is only available after the user authenticates to a secured portal. To help protect users, Check Point Email Security now introduces a dedicated AI engine that analyzes these messages and delivers significantly more accurate phishing verdicts by distinguishing between phishing, suspicious, and legitimate secured emails.

Previously, when a secured email was received from a new sender distributing multiple encrypted messages for the first time, the default workflow was to classify the email as suspected phishing. While this approach provided protection against potential attacks, it could also result in unnecessary alerts for legitimate encrypted communications.

The new AI engine is specifically fine-tuned to identify phishing indicators that are available even when the email content itself cannot be scanned. Instead of relying primarily on sender reputation and behavioral signals, Check Point Email Security now evaluates multiple characteristics of secured emails to determine whether they should be classified as phishing, suspicious, or clean. This provides stronger protection against phishing campaigns while significantly reducing false positives for legitimate encrypted business communications.

To modify this behavior, navigate to Security Settings > Security Engines > Anti Phishing > Secured (encrypted) emails and select the workflow that best fits your organization’s requirements.

The new AI-based detection engine is now the default workflow for handling secured (encrypted) emails, unless you actively modified the default value of the configuration above in the past.

For even stronger protection, organizations can deploy the Check Point Browser Protection add-on, which extends security for encrypted emails by protecting users when they access secured message content. For more information, please contact your Check Point representative.