Sophos Email Monitoring System

Sophos Email Monitoring System, or EMS, examines copies of emails and reveals threats that an existing security solution may have missed. Companies can retain their current email security while gaining additional information for investigations. Original messages are delivered unchanged: EMS monitors email traffic rather than blocking it through a filter in front of delivery.

Greater visibility alongside existing protection

Additional visibility does not require replacing Microsoft Defender for Microsoft 365, Google Workspace Security or another email protection service. Through journaling, EMS receives copies of incoming and outgoing emails and checks them for suspicious content. Results are logged in the central Sophos management console. The IT team gains additional findings while the existing service continues to control actual delivery.

Connect email findings to an incident

A suspicious message may be the starting point for a compromised user or unusual activity on a device. EMS provides email context to the Sophos Data Lake and supports investigations with Sophos XDR or MDR. This helps assess several related findings together. EMS alone does not include an analyst-led MDR service; those services require the appropriate additional entitlement.

Monitor and respond selectively

Monitoring means that configured EMS filtering actions are not applied to the original message. For Microsoft 365, manual clawback of supported messages is possible once the appropriate API connection is established. This targeted action differs from automatic filtering before delivery and is not available for every email platform.

Visibility also has limits: emails blocked by Microsoft 365 or Gmail before a journal copy is created never reach EMS. Internal messages between domains in the same Sophos account are not examined either. An incident assessment must therefore still consider the entire email environment.

When EMS is the right addition

Sophos Email Monitoring System is particularly suitable for companies satisfied with their current email security that need additional detection and investigation data. Sophos Email serves a different role: actively protecting messages and controlling their processing.

Setup depends on the supported email platform, domain connection and journaling configuration. Users and shared mailboxes are licensed within the agreed scope. EMS is also included in Sophos Workspace Protection; check any existing entitlement before buying an additional licence.