Stage 01
Inspect incoming message
Filters check real-time blacklists, recipient validity, SPF, and anti-spoofing signals.
Output: Sender and message signals
← Products
Xcitium offering
Email Protection
Email filtering for malicious links and attachments. URLs and attachments are inspected before delivery. Multilayer analysis helps detect phishing and zero-day threats.
Discuss your requirements ↗
Layered filtering for incoming email
Check spam and malicious links before delivery
Incoming messages are filtered using rules, reputation, and sender checks. Machine learning, link rewriting, and sandbox analysis support protection aligned with organizational policy.
Stage 02
Score with rules and behavior
Predefined rules assign a spam probability score; machine learning detects patterns that differ from typical email received by the organization.
Output: Score compared with a policy threshold
Stage 03
Check links and files
Dynamic lists, link rewriting, time-of-click checks, and sandbox analysis help detect email threats.
Output: Link and malware checks
Stage 04
Deliver according to policy
Spam above the threshold is blocked; a message may be deleted, held for a set period, or moved to a spam folder. Quarantine review and reports provide visibility.
Output: Delivery or quarantine decision
Incoming emailSender · recipient · SPF · spoofing
Heuristic rulesSpam score and policy threshold
Rewritten linkTime-of-click checkSandbox analysis
Mail serverBlock · delete · hold · spam folder
Quarantine and reports
Capabilities
Capabilities with a specific purpose
Multi-layer mail filtering
Combines sender and message signals, including real-time blacklists, recipient verification, SPF, and anti-spoofing. Xcitium also describes heuristic rules and a spam threshold.
Impersonation and spoofing controls
Helps identify messages impersonating a trusted sender. White, black, and grey lists plus organization-defined rules can be aligned with sender policy.
URL and attachment analysis
Link rewriting supports time-of-click checks, while sandboxing helps examine emerging malware not present in an antivirus database. Fit inspection stages to the mail platform.
Anomaly-based ML
Machine learning compares incoming mail with typical organizational patterns to help identify deviations. Review model signals and result explanations with security analysts.
Flexible policies and quarantine
Geo-blocking and organization-defined policies shape threat handling. Spam can be deleted, retained for a defined period, or moved to a folder; quarantine supports false-positive review and release.
Compare approaches
Email and web gateway controls
| Consideration | Email Protection | Web Protection |
|---|---|---|
| Traffic type | Incoming mail, senders, attachments, and email links. | User web requests and URLs. |
| Key signals | SPF, recipient verification, spoofing, reputation, behaviour, and sandboxing. | URL, category, keyword, rating, and user policy. |
| Risk point | Before mail reaches the inbox and when a link is clicked. | When a user attempts to visit a site. |
| User exception | Review and release a false positive from quarantine. | Review allow/block lists or adjust a policy exception. |
Before you start
Plan a mail gateway pilot
Validate mail flow, quarantine decisions, and time-of-click checks with a limited user group. Define false-positive release, sender exceptions, and incident escalation ownership.
- 01
How will MX and mail routing change, and who owns rollback?
- 02
Which message types receive link rewriting and sandbox checks?
- 03
How and by whom are false positives released from quarantine?
- 04
Who maintains SPF, recipient verification, geo-blocking, and allowlists?
Evidence for your evaluation
In practice
Responding to an impersonation campaign
Finance staff receive fake invoices that appear to come from an executive. Mail filters review sender, recipient, and message signals, and suspicious mail is quarantined according to policy.
What your team gains
- 01
Layered checks for spoofing, malicious links, and attachments.
- 02
Policy options such as geo-blocking and time-of-click protection.
- 03
Visibility into quarantine and blocked threats.
Before you decide
Questions, answered
How does Email Protection identify spam and phishing?
Xcitium provides heuristic filters, probability scoring and thresholds, real-time blacklists, recipient verification, SPF, and anti-spoofing. Tune thresholds to the organization’s mail flow.
How are URLs and attachments checked?
Available features include time-of-click link checks, attachment sandboxing, and ML. Confirm which messages pass through each stage for the chosen mail platform.
How can a false positive be restored?
Quarantine supports review and release of false positives. Define who can release messages and how long they are retained.
Next step
Discuss your requirements
Tell us about your environment and priorities to discuss the right solution, pilot scope and rollout in Azerbaijan.